I got it too.... Alureon-K...

[FallenAnjel]

I assume it's ok to continue to run all this via my thumbdrive correct?   Even if I could hook up the internet to it, my son is playing Xbox and it's keeping him out of my hair while I'm doing this. ;-) 

I've been using my thumbdrive all along, surprisingly it never got infected.  (nor has my laptop)

Is the computer clean now? 

[essexboy]

Yep it looks clean - it is now just damage repair time

Could you confirm that the net and windows updates work at some stage

And copying from a usb drive is not a problem 

[FallenAnjel]

Sure, I'll do that after I do the last instructions... 

[essexboy]

No rush 

[FallenAnjel]

No rush 

Well, actually..........   


I got the following messages when I ran the restore tools, but I can't find anything that was "restored".  Is that what the VBS script is for?

http://img198.imageshack.us/img198/6053/photomar2653250pm.jpg

http://img819.imageshack.us/img819/4852/photomar2653138pm.jpg


Except when I ran the VBS Script I got the following error:

http://img577.imageshack.us/img577/9296/photomar2653400pm.jpg

[essexboy]

OK I will check that out with the author and also check the vbs on my XP

[FallenAnjel]

Ok, thanks.   :-)

[FallenAnjel]

OK I will check that out with the author and also check the vbs on my XP

I realize you're in bed now (I think I read you're in England?), but I just realized something.   If you notice the pic of the error, the drive letter is "I".  That's my thumbdrive.  Since the computer is clean, I will hook up to the internet, and d/l the script onto the computer and run it from there.  (Same with the other two programs).   

I wonder if it's trying to work on the thumb drive because that's where it's installed.... 

I'll post back w/ my results.

[FallenAnjel]

Ok, little change of plans.  I connected back to the internet.  Just for grins and giggles, I ran Avast full scan again.  It found ? instances of the Alureon-K virus.  I was able to successfully able to delete them.  It asked to do a rootkit scan upon restarting.  I did that. 

I tried to run a program called, "Unhide".  That didn't work.  Didn't "unhide" anything. 

I then starting putzing around, and remembered about hiding/unhiding files.   So I went into My Documents and My PIctures and found that all the files were hidden.  I unhid them and !Viola! All back.     I couldn't remember how to unhide files on the C Drive.  Did a google search, and found it. (My Computer, Tools,. View).  Checked "Unhide" or whatever it was and another !Viola! Moment... EVERY SINGLE ICON IS BACK.   All programs, everything.  The only thing I can see that is gone right now are the homepages in Explorer, but the bookmarks and everyhting are there. 

There are a few glitches that I haven't figured out how to solve yet.   One is, every time I open up something on the desktop, the icons disappear, I then have to right click the bottom toolbar and chose "show Desktop".  I'm sure there's a fix for it, just haven't figured it out yet.   

I'll prob. run antoher scan of Avast and maybe WMSRT again.     

Essex, thanks so much for all your help! Guys like you are invaluable.  I can only hope one day to be doing what you're doing.   (I do a little bit, and normally can fix viruses, but this one was a nasty one, but now I have the tools to do it).

Now, if I can only get Windows Safari to stop refreshing on my Acer Laptop I'll be ok!  (That's like a carpenter living in a run down shack, lol)

[FallenAnjel]

I'm still trying to work on keeping the desktop icons visible, but here is a video I took of it happening.   I've also run HiJack this and I've attached the log, as I don't ALWAYS know what to look for.

Ooops, forgot to post link to video:

Excuse the sloppiness, I took it w/ the iPHone.

http://www.youtube.com/watch?v=4GZG3l7m6ps

[FallenAnjel]

Continue with aswMBR and OTL

I will do a rough and ready clean then we will use Rogue killer to get the icons back

I just remembered about this, I rean RK, the hide desktop icons thing showed in the log, and I deleted everything.

Icons still disappear whenever I do something. 

The boss is picking up the computer in a few minutes.  I will only be able to work via LogMeIn after that.  IDK why he needs it, he used his laptop on Sunday. 

Attached is my RK report.  I already used the "Delete" function.  Icons are still disappearing.   UGH!   

[FallenAnjel]

When all else fails....

RESTART THE COMPUTER! 

Yeah, the icons are staying now.  You know, when you are working on a computer for three days, sometimes you JUST FORGET to restart the computer, LOL....

Now the ONLY thing I'm stuck with is the error returned while accessing the msconfig utility. 

An Access Denied error was returned w hile attempting to change a service.  You may need to log on using an Administrator account to make the specified changes

The computer is back at work now, and told the boss to call em when he's done w/ his banking online so I can log in via LogMeIn and see how it's working there. 

My brain hurts, lol.   

[essexboy]

OK looks like a permissions error, RK was showing some bad MD5 signatures, so I would like you to run Combofix. After we have reset the damage.
Do you still have the icons disappearing problem ?   

So lets get the toolbox out 

Download  Windows Repair (all in one)  from this site

Install the programme then run (in this case you may skip steps 2 and 3 but allow the restore point and ERUNT to be set)

Go to step 2 and allow it to run Disc check


Once that is done then go to step 3 and allow it to run SFC



On the start repairs tab select advanced mode and click start


Leave the preselected ticks  and tick restart system when finished



After the reboot

Delete the current copy of Combofix from the desktop

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[FallenAnjel]

Well, the computer is back at work, so I prob. won't be doing that last bit of instructions.  Would be nice if I could.  Maybe this weekend, but I doubt it.    As far as the boss is concerned,  it works and that's good enough.  (He's old school anyway). 

Thanks so much for all your help and I will def. keep this post in mind if I ever get to work on the computer more. 

[essexboy]

Might be worth clearing the tools before he decides to play with them 

Or do you no longer have access ?