Found TDL4 Aluroot but can't remove

[essexboy]

What are your current problems ?

[masterchef]

First of all I want to thank you for all your help so far - you've been awesome 

One problem I have is that my All Programs tab from the Start menu has been stripped right back to about 20 progs, where it had maybe 100 or more previously (they still all appear to be in my program files folder luckily).

But the biggest problem is the Microsoft Office Accounting 2008 package that won't load up any more because a 'critical file is missing' (I mentioned this in an earlier post). I'm self employed and rely on that package completely. It was a download from Microsoft a few years ago. On attempting to reinstall I get a message saying the a source file is missing.

I found somewhere to download it again but am worried my existing data (invoices/records etc) might be deleted upon reinstalling. Any thoughts?

[essexboy]

What is the name of the file that is missing ?

Lets see if we can recover the missing elements

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :files
  xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C
  xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
  xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
  xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C
  
  
  :Commands
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[masterchef]

Unfortunately I don't know the missing file name

Will run the scan anyway!

[essexboy]

If you could try to find out which file is missing I may be able to rustle it up

The other alternative would be to use a free office package and transfer the data across

[masterchef]

Nearly there, don't go away! Just a couple more minutes....

[masterchef]

Okay here it is - see attached

[essexboy]

That looks to have brought some files/folders back, how does it look to you ? 

[masterchef]

Still not many programs in the All programs tab but to be honest, I don't mind! Just really happy to be rid of that nasty trojan. No idea how I got it - only recent downloads were an update to BBC iplayer and Adobe Air.

[essexboy]

There are many and varied ways to get but most rely to some degree on social engineering and get attached to updates

Let me know how it is behaving tomorrow and if you are happy I will tidy up

[masterchef]

Will do!

[masterchef]

Very happy! All running well and got my accounts prog up and running again 

[masterchef]

Quick update - just logged into my yahoo mail and at 00.04 this morning a load of spam was sent out from my account! I had a bunch of bounces which alerted me to it and when I checked my sent items it was all in there! I take it this means that the trojan has been sending my passwords out?! Just changed all passwords.....

[essexboy]

Yes change all the passwords, although this may not be related as a lot of spammers try to brute force passwords for webmail so that they can blame someone else for the spam

[masterchef]

Agghhhhhhhh! Just ran a full scan with Avast (just to be sure all was okay) and it found the dreaded Aluroot rkt again! I selected delete and it's now running a boot-time scan before restarting...