Win64/Alureon.gen!A*Virus preventing computer startup

kyle7282,

Do you have an installation CD/DVD for Windows 7?

If not, or, when you start the computer, tap the F8 key until the Advanced Boot Options menu appears.
Do you have access to the Repair your computer menu item?

Also, do you have a USB pen drive?

We need to run a tool from outside of Windows, but, need to know the above.

Another option:

Do you have access to a computer with Windows 7 64-bit system, to create a System Repair Disk:

Instructions:
System Repair Disc - Create

kyle7282 said:

I attempted to download Windows Defender Offline to get rid of it but after successfully downloading and implementing the program my computer has been unable to start up and recieves an error regardless of if I do

Did you actually remove Alureon? WDO is good for detecting it, but doesn't always remove it. For that you need a rootkit tool like TDSSKiller. It would be a good idea to make sure it's gone before implementing repairs.

Alureon creates a cloaked boot partition which generally does not show up on Windows Disk Management & can be hard to get rid of. If that is still present, Alureon will always boot up before Windows does.

If you want to be sure it's gone, you can d/l a boot partition manager called GParted. Alureon shows up at the end of the drive as a hidden boot partition, between 1 - 10 MB

Note from the MS Site:

Alureon may modify some driver files so they become corrupted and unusable. These corrupted files won't be restored by detecting and removing this threat. The corrupted file must be restored from backup to restore functionality to the computer. We recommend you boot into a recovery environment and manually replace the file with a clean copy.

Depending on the damage it did, some of your files may be irrevocably damaged. If after confirming Alureon is gone & the system repair disk does not help, you may be able to do a repair install.

Repair Install

Meanwhile, it might be prudent to migrate as many of your personal files to another storage medium just in case.

kyle7282,

The number of borked systems found because Windows Defender Offline was used to remove Alureon is more than what can be counted. WDO and Alureon do not seem to get along!!

There is a tool, Farbar Recovery Scan Tool that is used successfully to bring the system 'back to life', after the above described event.

However, the question at this point is, using the Windows 7 System Repair Disc you just created, can you boot to the System Recovery Options (Option Two), as per the following Instructions:
System Recovery Options

Can you select: Command Prompt?

If so, we are in business.

To get the Windows 7 System Repair Disc to work, you need to boot the computer from the CD created:

1. Restart or turn on the infected computer with the disc in the CD/DVD drive
2. Go to the boot menu of the computer.

To access the boot menu, you need to press a specific key while the computer starts up.
Different computers have different ways of accessing the boot menu.
Some of the boot menu keys are listed below.
◦Dell: F12
◦HP: ESC (boot device options)
◦Other: F12

Note:
◦You must press a key like the ones described above before Windows begins to load.
◦Next, change the boot order in the BIOS.

3. Once you see a boot menu, you can look for the following option:
CD/DVD Drive (or something similar)

Use the arrow keys to select the appropriate option and then press the Enter key.