Solved Trojan Alureon.A Detected After Clean Win7 Install

[sharona]

A brief intro: I'm working on a family friend's laptop. It's a Dell Vostro 3550. After doing a factory reset, I was still getting tons of BSODs. You can find info on all that in this thread. I did a Clean Windows 7 install because all signs pointed to hardware issues, but we wanted to be sure.

The only things I put on the laptop were a WiFi driver, Windows Updates, and MSE. MSE immediately detected Trojan Alureon.A. I had it do what it could, then it suggested using Window Defender to finish up removal. Before I did that, I did some googling. I installed MalwareBytes Anti-Malware, which detected nothing. I then got Kapersky's TDSSKiller.exe, which detected the rootkit and seems to have successfully removed it. I rescanned with all tools after reboot. MSE showed that it had detected, but successfully quarantined tons of variants containing "Trojan Alureon" in their name, but different letters at the end. I had it remove them, which it did. I've rebooted several times, run scans with all programs multiple times, and all seems clear. I wanted to make sure I was out of the woods before I continued gradually installing drivers and programs. Someone in my thread told me to come and post here.

 

[Borg 386]

Did you format the HD before you installed Windows?

Since Alureon writes it's own cloaked boot partition, it's possible it survived the re-install if you didn't wipe the disk.

If you didn't wipe the disk & you haven't put too much into the current installation, it might be worth it to use DBan to make sure everything is erased.

Darik's Boot And Nuke | Hard Drive Disk Wipe and Data Clearing

It's also possible one of your source disks may have the infection. If you backed up your drivers & such while the PC was infected, then it could have transferred to the backup media.

 

[sharona]

Thanks so much for replying, Borg!

If the virus did hitch on to something, it was probably the HD. I downloaded the installer for Win7 from my personal laptop, as well as the WiFi driver I mentioned. I have not returned the documents/files to the laptop, yet. When I was reinstalling, I noticed there were 3 partitions: Boot, Recovery, and OS. Will the HD wipe format/clean all three? I know that's probably a stupid question, but I wanted to make sure I completely understood everything.

 

[VistaKing]

sharona

Yes that will wipe the entire Hard Drive including the 3 partitions. We will have Cottonball take a look at this tread.

 

[sharona]

Okay, thanks! I am running the autonuke options per the directions.

 

[VistaKing]

AutoNuke will format your hard drive . Is that what you want to do ?

 

[sharona]

Yes, from what I understand that's the best way to make sure the virus isn't hiding somewhere on the HD. I will just need to do another clean install afterwards. Is that correct?

 

[VistaKing]

Yes but if you're getting the Alueron from a clean installation . I believe that could be coming from your Flash Drive. Try to do a scan on your flash drive.

We could also format the flash drive if you don't have anything important in there.

 

[sharona]

Flash drive, like the usb drive? I have a 1 TB external hard drive, which I back stuff up on. I used a DVD to reinstall Windows 7. But, I did download the wifi driver via my own laptop and put it on the usb drive to transfer to the problem laptop. I'll scan it for viruses/malware to double-check.

 

[VistaKing]

Can you show a scrnshot of your Disk Management ?

:ar: http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html

 

[sharona]

Of the external USB HD or the laptop's HD?

(If the latter, like I said, I had already started running autonuke after Borg's initial reply. I had done some googling after my reply and answered my own question, so I thought it was what I needed to do. I ran it before the format, though, and can remember a lot of the information, if you did indeed need that and not the external drive. )

 

[VistaKing]

The Disk Management shows all of the hard drives on the PC including partitions.

If you already went ahead and started the format of the Laptop's hard drive . Nothing is needed now until we are done with the installation and we do some scans.

My recommendation would be leave the formatting for the last option .

 

[sharona]

Okay, thank you. (I thought I might have messed up for a second.) I'll let you know when the wipe's done and I've reinstalled the OS.

 

[VistaKing]

The wipe will take a while. Its going through every sector on the drive. Installation from a DVD clean install should take no more then 25-45 mins depending on the hardware. Installation from a USB flash drive 15-25 mins .

 

[Borg 386]

I noticed there were 3 partitions: Boot, Recovery, and OS.

Windows disk management, in many cases, won't show you the hidden Alureon boot partition since it cloaks itself.

To see it, you need a boot partition manager like GParted. It will show up as a hidden partition at the end of the drive, usually 1 - 10 MB in size depending on the variant. Wiping the entire drive erases it.

If, after wiping the drive & doing a clean install you find Alureon again, one of your backup files is very likely infected.

 

[cottonball]

sharona,

Borg 386: If, after wiping the drive & doing a clean install you find Alureon again, one of your backup files is very likely infected.

Alureon is not a good thing. Just let us know when you are done with the clean install, and we will take it from there.

 

[VistaKing]

Sharina how's the installation coming ?

 

[sharona]

VistaKing, DBAN is still running. It says it's got about 3.5 hours still left. I have work tomorrow, so I don't know if I'll be up late enough to get a reinstall done tonight.

However, I'm currently running scans on my external hd. It looks like something might be there, not sure what yet, though. I went ahead and bought some blank CDs so I can put a copy of the WiFi driver on one instead of using the usb device to be on the safe side.

 

[VistaKing]

What are you using to scan on the external drive ? Does it say it found items ?

 

[sharona]

Currently using MalwareBytes to scan it. Scan's still running, been running for about 1.5 hours. It says it's detected 2 objects so far. Not sure how much longer til it's through. I was going to run MSE overnight as it's going to take several hours.