Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: boot:\physicaldrive0\partition3 (type 17) Alureon.E (virus)trojan


12 Jun 2012   #1

Windows 7 home premium 64bit
 
 
boot:\physicaldrive0\partition3 (type 17) Alureon.E (virus)trojan

Good afternoon/evening, Sevenforums professionals


My name is kyle and I'm looking for help to remove/cure some issues I'm having with my desktop Gateway PC. This is on a Windows 7 home premium 64bit, i3 processor.

Here are the problems detected by Microsoft Security Essentials:

boot:\device\hardiskVolume4
boot:\device\harddiskVolume4\

boot:\physicaldrive0\partition3 (type 17)

I've tried over and over to remove this trojan virus Microsoft Security Essential will not remove it...However it will detect it once the computer has been started and then every 3 minutes the notification pops up via MSE saying pc at risk threats detected. Then its lists what I've typed in RED fonts above.

I've taken one screen shot of the of MBRcheck.exe scan and I will attach it. Also I've taken one data log of aswMBR.log scan and will attach that as well.

Any help on this will be greatly appreciated, thanks in advance for you're expertise and precision.

warmest regards,

kyle miller








Attached Thumbnails
boot:\physicaldrive0\partition3 (type 17) Alureon.E (virus)trojan-screenshot-1.jpg  
Attached Files
File Type: txt aswMBR.logs.txt (1.6 KB, 20 views)
My System SpecsSystem Spec
.

12 Jun 2012   #2

Microsoft Community Contributor Award Recipient

Win 7 Pro 64-bit
 
 

Hello kyle and welcome to Seven Forums.

If you're dealing with the Alureon Trojan you might want to look through this Forum thread for suggestions. In particular, read what Borg 386 has to say about this (post # 8.)

MSE Trojan Cleanup Prompt
My System SpecsSystem Spec
12 Jun 2012   #3

Windows 7 home premium 64bit
 
 

Good afternoon, Marsmimar


Thanks for the suggestion and I will definitely go have and read that entire thread.

Once again thanks for having me as a newcomer to SevenForums.

best regards,

kyle miller
My System SpecsSystem Spec
.


12 Jun 2012   #4

Windows 7 home premium 64bit
 
 

Marsmimar,

I finished reading the thread you suggested, I can say unequivocally..... that "MalwareBytes does not work on this Alureon.E virus/trojan as I've tried it at least 40+ times. "The backdoor.Tidserv removal Tool" by symantec Locates the virus/trojan on my computer. And it runs and attempts to remove the Alureon.E virus and then my computer reboots and fails to starts the windows logo on process. I've tried this 3 times already. So then I have to Reboot the computer in Safe Mode and then restore the computer to point that working prior to running "The backdoor.Tiderv Removal Tool". This Does not work for my computer Windows 7 home prem....only makes the computer NOT boot. This virus is very very NASTY.

TDSSkiller finds the virus also and then.... cures it and reboots the pc..... and the computer boots fine into the desktop. All is well for 45 seconds..... However... Microsoft Essentials Security then alerts of me Detected threats and of course its the Alureon.E virus again ..... with the details saying...

boot:\device\hardiskVolume4
boot:\device\harddiskVolume4\

boot:\physicaldrive0\partition3 (type 17).

I understand the clean install maybe a factor I have to perform... Only as can we exhaust all other options first. What are you thoughts or suggestions I am open to all ideas and task..I am very capable and have no problem following instructions...

Anyone that can help or provide further insight or feedback to a possible cure... I am yours


Sincerely,

Kyle Miller



My System SpecsSystem Spec
12 Jun 2012   #5

Windows 7 Professional SP1 64-bit
 
 

Here is a link to Hiren's BootCD. Borg has already posted instructions but to repeat, you need to delete the small partition that was created by Alureon. If you see more than one partition that you don't know what they are, you can post a list of the different partitions and we will help you identify which one it is.

http://www.hirensbootcd.org/download/
My System SpecsSystem Spec
12 Jun 2012   #6

Windows 7 home premium 64bit
 
 

Thanks Petey!!!

I'm in the process of booting the infected computer now....

Will post shortly.
My System SpecsSystem Spec
12 Jun 2012   #7

Windows 7 home premium 64bit
 
 



One moment
My System SpecsSystem Spec
12 Jun 2012   #8

Windows 7 home premium 64bit
 
 

Good afternoon Petey,

Listed below is exactly what I see after running the( HirenBootCD ) on my desktop.. I attached the information After putting it into Excel and screen capturing it. So that it is organized. This the information displays on screen of the partitions on my Gateway PC. I'm playing it safe and do not want to delete any partitions myself.. for obvious ramifications will result. Have a look at the the information below and advise me what to do next once you get a chance and what to keep and want to delete.

Thanks for your expertise in these matters,

Kyle Miller.


Attached Thumbnails
boot:\physicaldrive0\partition3 (type 17) Alureon.E (virus)trojan-paritions-hdd-gateway..jpg  
My System SpecsSystem Spec
12 Jun 2012   #9

Windows 7 Professional SP1 64-bit
 
 

The partition that says (Hidden) is the partition that contains the virus. Delete the partition using Hiren's BootCD. Download and burn Windows Defender Offline (WDO) to a CD. Immediately after deleteing the partition, boot-up WDO and run it. It should completely remove the virus. After booting into Windows, go ahead and run a virus scan with your regular AV just to be sure.

http://windows.microsoft.com/en-US/w...fender-offline <-- WDO
My System SpecsSystem Spec
12 Jun 2012   #10

Windows 7 home premium 64bit
 
 

Petey you are the SEALS TEAM 6 of the PC world !!! YOU F8CKING ROCK!!!

I DELETED THE partition you directed me to and rebooted as asked then ran the WDO and you are 100% correct sir it did remove the virus, No let me call it what it really is... ALUREON.E is the HIV of the PC world. I been up 38 hours no sleep looking for a cure and you had the answer.

And I did run MALWAREbytes and Microsoft Essentials, TDSSkiller as well, NOT all at the same time of course. Just to make sure I ran MBRcheck and aswMBR... Nothing detected!!!

You sir are a GENIUS!!! If I wasn't a man I would kiss you!! But obviously I can't because real men don't do those things. However I am forever grateful to you and I will make a donation!

Sincerely Grateful Hopeful wishing you all the best in the world PETEY,

Kyle Miller
My System SpecsSystem Spec
Reply

 boot:\physicaldrive0\partition3 (type 17) Alureon.E (virus)trojan




Thread Tools



Similar help and support threads for2: boot:\physicaldrive0\partition3 (type 17) Alureon.E (virus)trojan
Thread Forum
Solved Trojan Alureon.A Detected After Clean Win7 Install System Security
Windows 7 won't boot after removal of Alureon System Security
Solved Alureon.E (virus)trojan System Security
Want are the best afforable anti-virus for a trojan virus System Security
Trojan type/how to remove manually System Security
Solved Trojan:DOS/Alureon.A System Security
Alureon Bootkit Trojan - Crossing the 64 bit Barrier System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 12:53 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33