up vote 1 down vote favorite
share [g+] share [fb]

Another Windows question. I have another friend's Win 7 Enterprise system that was infected with about half a million viruses (give or take). I actually managed to remove all but "Alureon" -- it simply will not go away. Now, whatever was there previously manipulated the system such that:

1) It can't run Windows Update 2) using bootrec.exe /rebuildbcd and /scanos yields 0 Windows installs

I've checked all proxy settings and used several tools (including a linux boot disc) to search for viruses. I'm not really sure where to go from here. It's actually a business machine and (as is often the case) a full wipe isn't possible for the next couple of weeks while summer school is in, etc.

FYI, I've consulted the following without success:

http://social.technet.microsoft.com/Forums/en-US/w7itproinstall/thread/7791044e-db7f-4144-a96c-945299811f58/

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:DOS/Alureon.A

Any assistance is greatly appreciated.

link|improve this question
50% accept rate
feedback

3 Answers

up vote 0 down vote

Before I went on, I would also try Hitman Pro, and then, if necessary, use the following tool of last resort: Combofix.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

I say "of last resort" because if the boot sector is infected, there is a chance that it could render the computer unbootable, but it can be fixed, and the data is still there. You just may be back with a different question. That said, it does not happen often.

This has gotten the rid of some of the most stubborn viruses I have ever had.

You may also want to flash the BIOS with the latest firmware. Just yesterday, an IT friend told me that he had to flash a BIOS because the virus was written there. So every time the system booted, even with a new hard drive, it would be reinfected.

link|improve this answer
Awesome thx. Question: Why is "combofix" touted as such a scary deal? I seems to run just fine without doing anything nefarious. And none of the activities it performs are anything you couldn't do yourself. – humble_coder Jun 28 '11 at 14:23
@humble_coder Simply because it can render a comp unbootable. Did it fix your problem? If so, would you please mark the question as answered (click the checkmark)? Thank you. – KCotreau Jun 28 '11 at 14:33
Yes and no. Alureon appears to be gone, but there are still several "search hijacks" present. O_o I'll def mark it (and update this post) as soon as I've got a "complete" solution. Thanks. – humble_coder Jun 28 '11 at 17:22
feedback
up vote 0 down vote

Quit messing around with it and just wipe it. In the time you've already spent trying to fix it, you could have probably re-installed a dozen times.

After setting it up, image the hard drive, so that if this happens again, it will only take a few minutes to fix.

link|improve this answer
1  
I mostly agree with you, but it still runs, just veeeeery slowly. He has lots of Enterprise-y things set up that are configured for work and can't afford to un-enterprise until next month. At that point a wipe will occur. He just needs a short term fix if at all possible. – humble_coder Jun 28 '11 at 4:35
Yes, it runs "veeeeery slowly" because the malware is probably using his computer to run torrents or similar. I think that you both underestimate the potential seriousness wrt loss of company/personal information, and possible unknown illegal activity that the pc may now be involved in. Fuck it. Learn the hard way. – Joe Internet Jun 28 '11 at 8:16
No underestimation. But he's stuck between a rock and a hard place. I honestly have no dog in the fight. I'm just a friend who's a software dev that he occasionally brings his computers to because I'm "the computer guy". I'm personally a Mac/Linux user so that's my solution, but given his situation, I understand his point of view and will try to respect it in the short term if even remotely possible. This certainly isn't his first virus and he's fully aware of the potential loss(es) ahead. Legality of the activity isn't really much of a concern -- but I'll leave it at that. – humble_coder Jun 28 '11 at 14:22
feedback
up vote 0 down vote

So my thought is similar to Joe Internet's, but different.

  1. Image (copy) the disk(s). Never know what you will need tomorrow.
  2. While he's out of the office (yeah, extra work, but that's life), do a new install to a third new disk.
  3. Install all of the enterprisey goodness including A/V. Verify that it is again fast.
  4. Image the new good disk. You don't want to waste that night of effort.
  5. Attach the known evil disk to the new good disk in a safe (wave-hands) way and copy the critical data off of it, doing A/V scans all the way (turn the settings up to super-high, if it has them. 200 false positives is better than one false negative undoing all of your work).

At this point it is 5AM, you're exhausted, but you have options. They are:

  • Slow configuration he was working (functional) with before. (your worst case is status quo which he was happy with for a few weeks.)

  • Fast configuration without (potentially?) critical data. (your best case, but realistically speaking probably not functional)

  • A probably fast configuration with all of the data files that you could figure out he needed. (likely your boss's best case).

In addition, you have a backup of the current state, and a backup of your known-good state, so in 2 weeks you don't have to do any work.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.