The Dreaded ALUREON-K rkt VIRUS ...grrrrrrr HELP!

[jeffce]

Hi,

Seems that worked well. 

Malwarebytes

I see that you have Malwarebytes already on your computer.  Please open Malwarebytes, update it and then run a Quick Scan.  Save the log that is created for your next reply.
----------

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here then click on:
  

• Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.

All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
  
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  
• Now click on Advanced Settings and select the following:
  
  • Scan for potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth Technology
    
• Now click on:
  
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  
• When completed the Online Scan will begin automatically.
  
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  
• Now click on:
  
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
----------

In your next reply please attach the logs made by Malwarebytes and ESET online scanner. 

[Jessette0514]

Completed Malwarebytes scan and ESET scan - logs attached.

[jeffce]

Hi,

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  

Code: [Select]

ClearJavaCache::

File::
C:\Program Files\RegistryFix8\RegFix8.exe
C:\Program Files\RegistryFix8\UninstlDll.dll


• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
  
  
  
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
  

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
----------

In your next reply please attach the ComboFix log and let me know how your system is running.  :)

[Jessette0514]

Things are running much faster now on my computer. I still can't access some pictures and files, but majority of things seem to be ok. I attached the combofix log as well. I really appreciate all your help Jeff! You're a godsend!

[jeffce]

Hi,

The ComboFix log looks good.  I noticed that you have some remnants of Avira on your system?  Did you used to have that?

Please open OTL.

• Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, click the None button near the top (it may looked greyed out)
  
• In the Extra Registry section change it to All
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  

When the scan completes, it will open 2 notepad windows, OTL.Txt and Extra.txt. Please post the Extra.txt.

[Jessette0514]

Yes I did have Avira on my computer and I tried to uninstall it awhile ago, but had a difficult time doing it, so it's still there. Here's the OTL & Extra log. Thanks again!

[jeffce]

Hi,

Download and run the tool found here >> http://dlpro.antivir.com/package/regcleaner/win32/en/avira_registry_cleaner_en.zip to remove Avira.

[Jessette0514]

Thanks Jeff  - ran the cleaner - it says it can not delete all the files though. here are the ones it can't remove.

HKEY_LOCAL_MACHINE\SOFTWARE\Avira
HKEY_LOCAL_MACHINE\SOFTWARE\X-AVCSD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\avgntflt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\avipbb
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\avast! Antivirus
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avast! Antivirus
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avgntflt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avipbb

[jeffce]

Hi,

Please download OTM by OldTimer.

• Save it to your desktop.
  
• Please Right-click and Run as Administrator OTM and then click >> run.
  
• Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  

Code: [Select]

:Processes
explorer.exe

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Avira]
[-HKEY_LOCAL_MACHINE\SOFTWARE\X-AVCSD]

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]


• Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Attach the log created into your next reply.
• Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.