Windows 7 won't boot after removal of Alureon

[RustyBrotherton]

I removed the Alureon Virus following some steps that were given to me via MS Security Essentials. Now I am getting a BSOD and cant get into anything except repair your system.

I have ran frst64.exe because of some other threads that I read. I am not sure what to do now. I am attaching the log from running frst64.exe.

Thanks for any help.

 

[cottonball]

RustyBrotherton,

Please do the following:

Open notepad (Start > All Programs > Accessories > Notepad)
Copy the entire contents of the quote box below (Do not copy the word 'Quote');
Save it on the pendrive that has FRST64 and name it: fixlist.txt

start
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$3b99f81f31d5dbab1bcf87d0107a285a\n. ATTENTION! ====> ZeroAccess
AppInit_DLLs: [0 ] ()
C:\Users\Amy\Application Data\eufihagb
C:\Users\Amy\AppData\Roaming\eufihagb
TDL4: custom:26000022 <===== ATTENTION!
end

WARNING: This script is written specifically for RustyBrotherton, and, for use on this computer.
Running this on another computer may cause damage to the Operating System!!

Now, please enter System Recovery Options and select the Command Prompt as done before.
Run FRST64, and press the Fix button, just once, and wait.

FRST reboots the computer.

When done, the tool creates a report on the pendrive called: Fixlog.txt
Please post Fixlog.txt in your reply.

Post back on whether you can boot normally to Windows.

 

[RustyBrotherton]

I just booted into Windows normally!!!

Here is the log.

You guys are seriously amazing!!

 

[VistaKing]

RustyBrotherton

Once you're up and running . I recommend removing McAfee

McAfee Removal Tool :ar: MCPR.exe

Drag the MCPR.exe file from your Downloads folder to your Desktop folder

:ar: Right-click MCPR.exe, and select Run as administrator.

:ar: If you get a User Access Control window click on the Yes button

:ar: At the End User License Agreement (EULA) dialog box, click Next button to accept the agreement.

 

[cottonball]

Please hold off on McAfee until we get done removing the malware.

Will be back shortly...

 

[VistaKing]

Yes cottonball that is why I said once you're up in running . Meaning when the virus is removed .

 

[RustyBrotherton]

I just ran tdsskiller.exe and it said no threats found. Additionally I loaded MS Security Essentials and it found no threats as well.

I might have been to quick but I had already ran the MCPR.exe

 

[cottonball]

We are switching to the Desktop...no pendrive.
Also, TDSSKiller produced a report. Please post it in your reply.

:info:
Please go to the: Farbar Recovery Scan Tool Download
Select the 64-bit version.
Save it to your Desktop.
You will use it shortly.

:info:
Open Notepad (Start > All Programs > Accessories > Notepad)
Copy/paste all the contents of the quote box below to Notepad (do not copy the word 'Quote').
Save it on the Desktop as: fixlist.txt

start
DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
end

Run FRST64 again (from the Desktop), but this time press the Fix button just once, and wait.
When done, the tool makes a log on the Desktop.
Please post Fixlog.txt in your reply.

:info:
Since the following steps involve editing the Registry, please create new restore point before proceeding.
http://www.sevenforums.com/tutorials/697-system-restore-point-create.html
Select: Option Two

:info:
Now, please download the ESET ServiceRepair:
http://kb.eset.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe
Save to the Desktop.
Double-click and run the downloaded file.

When the program runs, a prompt appears asking if you want to proceed.
Click: Yes
When the Services routine is Completed, you are asked to Reboot.
Click Yes to allow the reboot.

The tool creates a folder named CC Support on the Desktop.
Please provide the CC Support\Logs\SvcRepair.txt in your reply.

:info:
Last, please take action Downloading Farbar Service Scanner
Save to the Desktop
Make sure the following options are checked:

Internet Services
Windows Firewall
System Restore
Security Center
Windows Update
Windows Defender

Press: Scan

FSS creates a log, FSS.txt, on the Desktop.
Please provide the FSS.txt in your reply.

:info:
Need for you to attach 4 reports:
TDSSKiller
Fixlog.txt from FRST64
SvcRepair.txt
FSS.txt

 

[RustyBrotherton]

OK here are the logs.
View attachment TDSSKiller Report.txt
View attachment Fixlog.txt
View attachment SvcRepair.log
View attachment FSS.txt

 

[cottonball]

RustyBrotherton,

There is still some more work to do, but the mean malwre is out of the picture.

VistaKing, in California, will run you through the routine of geting rid of McAfee.


In Illinois, it is 12:45AM, past my night-night time.

Will se ya later, probably in the afternoon!

 

[cottonball]

Let's press on...

:info:
Since the following steps involve editing the Registry, please create new restore point before proceeding:
http://www.sevenforums.com/tutorials/697-system-restore-point-create.html
Select: Option Two

:info:
Next, download the following file to the Desktop, right-click on the file, and select: Merge
Allow the Registry merge.

WinDefend:
http://download.bleepingcomputer.com/win-services/7/WinDefend.reg

:info:
Next, press the Windows key and the R key to open the Run prompt.
In the Run box, type: notepad
Press: OK

Highlight the entire contents inside the following quote box, and copy/paste the text to Notepad.

@Echo off
sc config windefend start= manual
shutdown -r -t 1
del %0

In Notepad, select File > Save As...
Press the Desktop entry on the left side.
In the File name box, type in: fixsvc.bat
Press: Save
Close: Notepad

Right-click fixsvc.bat on the Desktop, and select: Run As Administrator
Press Yes if prompted by the User Account Control.

When the batch commands are applied, Windows should restart. If not, please do so manually.

:info:
Last, run Farbar Service Scanner once again.
Select all the options.
Press: Scan
Please provide the new FSS.txt in your reply.