Win64/Alureon.gen!A*Virus preventing computer startup

I had some trouble with ransomware earlier...

Did this happen while you have been working on your issues with me?

What exactly happened?

...hope this doesn't affect what you've helped me do so far

Hard telling, but we cannot take any chances...

Please do the following:

(You may want to print these instructions, so they are available to follow.)

Load a USB flash drive with HitmanPro.Kickstart as follows...
Note: the contents of the USB flash drive are erased during this process!

Use a clean (non-infected) computer, and download:
HitmanPro.Kickstart - Anti ransomware, politievirus, bundestrojaner, Reveton, BKA, GVU - SurfRight

Under Download (on the right) select the program applicable to the infected system: 64-bit or 32-bit

When HitmanPro opens, click the KickStart icon at the bottom of the screen.

Plug in the USB flash drive.

When the USB flash drive is detected, a selection screen is presented.
Select the USB flash drive from the choices, and press: Install Kickstart
A warning that all contents of the selected flash drive will erase is presented.
Press: Yes

As the HitmanPro.Kickstart files are loaded, a progress indicator is shown on the screen.
Once the process is completed a screen is presented with the contents of HitmanPro.Kickstart

Remove the USB flash drive from the clean computer and press: Close


Now, with the problem computer shut down, plug the USB flash drive into a USB port, and turn on the power.

When the computer starts, press the key that brings up the Boot Menu. (On some machines its F12, F10, or F2)

From there, select to boot from the USB drive. (It may say 'Removable Drive' in the options.)
Info: How to Remove Ransomware - Select Real Security

Once you select the USB flash drive to boot from, press: Enter

A KickStart prompt with USB boot options appears.
Select: 1 (Bypass the Master Boot Record (Default))

The system continues to boot from the hard drive and starts Windows.

If you get a message stating that Windows failed to start, etc., just select: Start Windows Normally

When Windows boots, you either get a logon screen, or the Desktop is started.
If you see a logon screen with your User name, logon with it.

In the next prompt, to start the program without installing to the local hard disk, select the option to do: One-time scan to check the computer

To start scanning for malware press: Next

If malware is detected, the program's Scan Results shows what malware is present on the system.
Select Next to quarantine the malware into a secure storage where it can no longer start.

At the next screen, activate the 30-day free license.
After successful activation (30 days), press: Next

A screen indicating that the malware was successfully disabled or removed is presented.
Press: Next

To obtain a report of the scan results, press: Save log
Save the Notepad log!!
It has a name such as: HitmanPro_xxxxxxxx_xxxx


Remove the USB drive, and press: Reboot
If no malware is found, press: Close

After HitmanPro.Kickstart is done, you should be back into normal Windows.

Please post the HitmanPro log in your reply.

kyle7282,

My apology for the delay.

Have not forgotten you. There are a couple of entries in the HitmanPro report that are of concern.

Checking on them, and will get back with you as soon as possible.

Thanks for your patience.

kyle7282,

When you ran HitmanPro.Kickstart, did you follow these steps below, and the program indicated the malware was successfully disabled or removed?

If malware is detected, the program's Scan Results shows what malware is present on the system.
Select Next to quarantine the malware into a secure storage where it can no longer start.

At the next screen, activate the 30-day free license.
After successful activation (30 days), press: Next

A screen indicating that the malware was successfully disabled or removed is presented.

In any event, please do the following:


Please go to the Farbar Recovery Scan Tool Download
Get an updated copy of the program.
Select the version that applies to your system.
This time, save it to your Desktop.
Double-click the downloaded file to run it.

When the tool opens click Yes to the disclaimer.
Under Optional Scan check the option: List BCD
Press the Scan button.

FRST64 makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

Please provide the FRST.txt in your reply.

OK, let's press on...

Please run HijackThis, Scan, check box for the following:

R3 - URLSearchHook: (no name) - {cce665dd-f6dd-4808-968e-eaec971f70ef} - (no file)
O4 - HKCU\..\Run: [TempKeyedkfjsAdobe] C:\Adobe\rjNeY7PVTgjf\Loerijfsdantilib.exe
O4 - HKCU\..\Run: [JgDsClTqzA] C:\Users\Keenan\AppData\Roaming\iexplorer.exe

Select: Fix checked

Next, search for, and remove the following files:
C:\Adobe\rjNeY7PVTgjf\Loerijfsdantilib.exe
C:\Users\Keenan\AppData\Roaming\iexplorer.exe

Next, please submit the following file for analysis to VirusTotal:
http://www.virustotal.com/

File: C:\windows\SysWOW64\cmd.exe

Use the 'Choose File' button to navigate to the location of the file.

In the Choose file to upload prompt, select the file, then, click the 'Open' button.
The file is now displayed in the blank box of VirusTotal
Click: Scan It, and wait for the results.
If you get a message saying: File has already been analyzed, click: Reanalyze file now
Once scanned, please provide the link to the results page in your reply.


Next, download the Temporary File Cleaner (TFC)
http://oldtimer.geekstogo.com/TFC.exe
Save to your Desktop.

• Save any work in progress!! TFC closes open applications and removes unsaved work!!
• Close all windows.
• Right-click TFC.exe and select: Run as Administrator
• If prompted, click Yes to reboot.

Also download AdwCleaner:
http://www.bleepingcomputer.com/download/adwcleaner/

• Save the program to the Desktop
• Close all open programs and internet browsers.
• Right-click on adwcleaner.exe and select: Run As Administrator
• At the program console, click on: Delete
• When the program is done, the computer is rebooted automatically, and a text file opens after the restart.

Please post the AdwCleaner report in your reply.


Last, use the Junkware Removal Tool Download
Save to the Desktop.

Make sure you temporarily disable your AntiVirus, Firewall, and any other AntiSpyware applications.
These programs may interfere with the running of JRT.
Info: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides

Right-click JRT.exe and select: Run as Administrator

The tool opens and starts scanning the system. Please be patient as this can take a while...

When done, a report, JRT.txt is saved on the Desktop.

Please post the contents of JRT.txt in your reply.