Alureon Trojan / Log Files now present!

Originally ran yahoo anti spy and turned up alureon, droplet ew, and a few other infections. Computer began redirecting to websites and would not allow me to run either my anti virus or spyware / malware programs. Can't run Kaspersky AV, Malwarebytes, Spybot or any of a host of other diagnostic tools.

-[URL="http://virusinfo.info/showthread.php?t=9206"]Fix[/URL] with Hijackthis
[CODE]O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.101,85.255.112.113
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.101,85.255.112.113
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.101,85.255.112.113
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.101,85.255.112.113
O22 - SharedTaskScheduler: {03413bf7-e34c-445b-bfc0-a2b127255871} - incestuously - (no file)
[/CODE]

Reboot your system, update the AVZ-Database (File/Database Update) and make 3 new logs.

New logs uploaded.

[QUOTE=shadedsoul;435515]ran yahoo anti spy[/QUOTE]What a bullsh... did you use? ;)
- Start/Run..., copy & paste follow string:
[CODE]edit %systemroot%\system32\drivers\etc\hosts[/CODE]
press Enter, remove in the file all strings after 127.0.0.1 localhost.
File/Close/Safe changings ...

Any problem more?

Apparently the problem is still not resolved. Tried reinstalling Kaspersky. Once installation was complete, program would not run. Tried rebooting, computer would not reboot except for safe mode, or last known good configuration. Went back into dos to check on systemroot per last instructions and it seems they were not removed afterall. When I try to do so, I get the following message. "You cannot modify a read only file." How do I proceed to remove the files from this point? Also,I have attached new logs just in case.

[QUOTE=shadedsoul;436184]Tried reinstalling Kaspersky. [/QUOTE]Why? Did it run wrong? Did you use Kavremover: [url]http://support.kaspersky.com/faq/?qid=208279463[/url] ?
[QUOTE]Went back into dos to check on systemroot per last instructions and it seems they were not removed afterall.[/QUOTE]Do you use any other tool besides KAV? Do you have administrator rights?

Had to remove read only and was able to remove items from systemroot.

No other AV used. Using KAV 2009, so Kavremover is not necessary. Ran it anyway, but nothing was detected. After trying to reinstall KAV, system began redirecting again.

Also forgot to mention earlier. The only way I could get HijackThis to run originally was by renaming the app. Renamed it Jack This and program loaded fine. Renamed it HijackThis and would not start.

Try to check your system from CD or write-protected SDCard with CureIt from Dr.Web - possibly you have file viruses? The described from you behavior is extremely curious.

Will do. I have also attached the latest log files prior to running the scan.

-[URL="http://virusinfo.info/showthread.php?t=9206"]Fix[/URL] with Hijackthis
[CODE]R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R3 - URLSearchHook: (no name) - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - (no file)
O4 - HKCU\..\Policies\Explorer\Run: [{382AC062-0AEF-1033-0802-050718200001}] "C:\Program Files\Common Files\{382AC062-0AEF-1033-0802-050718200001}\Update.exe" mc-110-12-0000272
[/CODE]

Remove KAV completely, let KAVREMOVER run.
Reboot, download the last version of KAV, I suppose it should be just KAV2010, try to reinstall KAV,

Still no luck. Application installation runs. Appears to complete. Click on next to begin the application configuration wizard, and program will not load.

Here are the latest logs.

[B]Dr. Web report follows:[/B]
ctxad-437.0000\data002;C:\Documents and Settings\Owner\Application Data\APPATC~1\APPATC~1\ctxad-437.0000;Adware.ClickSpring;;
ctxad-437.0000;C:\Documents and Settings\Owner\Application Data\APPATC~1\APPATC~1;Archive contains infected objects;Moved.;
smitRem.exe\smitRem/Process.exe;C:\Documents and Settings\Owner\Desktop \smitRem.exe;Tool.Prockill;;
smitRem.exe\smitRem/pv.exe;C:\Documents and Settings\Owner\Desktop\smitRem.exe;Program.PrcView.3741;;
smitRem.exe;C:\Documents and Settings\Owner\Desktop;Archive contains infected objects;Moved.;
pv.exe;C:\Documents and Settings\Owner\Desktop\smitRem;Program.PrcView.3741;Incurable.Deleted.;

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL]
[CODE]
begin
SetAVZPMStatus(True);
RebootWindows(true);
end.
[/CODE]
After reboot
- Repeat a log file virusinfo_syscheck.zip

Updated script log.

Switch off/Disable:
- Antivirus and and, if you have - Firewall.
- System Restore

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('%SystemRoot%\system32\drivers\wdmaud.sys','');
QuarantineFile('%systemroot%\system32\drivers\ESQULnjcwmkqlvuquwfkutvqhpmnnabrxuscc.sys','');
DeleteFile('%systemroot%\system32\drivers\ESQULnjcwmkqlvuquwfkutvqhpmnnabrxuscc.sys');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL]
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]

- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Close all the programs and start only Internet Explorer!!!
- Repeat 3 log files.
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.
- Attach 3 logs to your new post..

New logs attached.

Kaspersky installed and is running a full scan presently. Will update with new logs when finished.

[QUOTE]Will update with new logs when finished. [/QUOTE]

JUST BEFORE [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
QuarantineFile('%systemroot%\system32\drivers\ESQULserv.sys','');
QuarantineFile('D:\autorun.inf','');
DeleteFile('D:\autorun.inf');
DeleteFile('%systemroot%\system32\drivers\ESQULserv.sys');
BC_ImportAll;
ExecuteSysClean;
BC_DeleteSvc('ESQULserv');
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL]
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]

- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Close all the programs and start only Internet Explorer!!!
- Repeat 3 log files.
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.
- Attach 3 logs to your new post..

Updated log files attached.

Everything seems to be running great. KAV installed completely and all apps are running accordingly. Let me know if I need anything else.

Thanks!!!

Did you execute my last script BEFORE making of logs?

Yes I did. Is there a problem?

Yep,there is a problem, because he can see that ESQULserv tracks are still in your system.
Lets try in this way:
Please download special avz archive from my signature. Unpack files to new folder.Disconnect from internet , disable your kaspersky and then launch special avz by clicking on Run.cmd file, execute this script in special avz:
[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\Program Files\SIFXINST\SIFXINST.EXE','');
QuarantineFile('C:\WINDOWS\system32\drivers\symlcbrd.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\ESQULserv.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\wdmaud.sys','');
DeleteFile('C:\WINDOWS\system32\drivers\symlcbrd.sys');
DeleteFile('C:\WINDOWS\system32\drivers\ESQULserv.sys');
BC_ImportAll;
ExecuteSysClean;
BC_DeleteSvc('ESQULserv');
BC_DeleteSvc('symlcbrd');
BC_Activate;
ExecuteRepair(6);
ExecuteRepair(8);
ExecuteRepair(9);
RebootWindows(true);
end.
[/code]

Upload quarantine according to rules(see
Appendix 3. How to send us requested files.)
Please make after reboot a new virusinfo_syscure.zip using this special avz, also i would like to see a log from the gmer.
[url]http://www.gmer.net/[/url] Do attach both to your next post.

I'm not seeing them still there. Am I missing them somewhere and just can't see them? I'll run the processes as soon as I get back in about an hour.

I may have inadvertently attached old files previously. I have performed the script requested just in case and have uploaded the new logs. Will post results of GMER scan when it completes.

GMER log attached.

Copy follow code into a new file
[CODE]gmer.exe -del service ESQULserv
gmer.exe -del reg " HKLM\SYSTEM\CurrentControlSet\Services\ESQULserv"
gmer.exe -del reg " HKLM\SYSTEM\CurrentControlSet001\Services\ESQULserv"
gmer.exe -del reg " HKLM\SYSTEM\CurrentControlSet002\Services\ESQULserv"
gmer.exe -del reg " HKLM\SYSTEM\CurrentControlSet003\Services\ESQULserv"
gmer.exe -del reg " HKLM\SYSTEM\CurrentControlSet004\Services\ESQULserv"
gmer.exe -del reg " HKLM\SYSTEM\CurrentControlSet005\Services\ESQULserv"
gmer.exe -del file "%systemroot%\system32\drivers\ESQULnjcwmkqlvuquwfkutvqhpmnnabrxuscc.sys"
gmer.exe -del file "%systemroot%\system32\ESQULrdajbvevobhxhyavykbgcrqenhhhifwi.dll"
gmer.exe -del file "%systemroot%\system32\ESQULxyiocviqvabanebapxrdngduogdangsm.dll"
gmer.exe -reboot[/CODE]
and save it in the same directory with gmer.exe with the name 123.bat
Start this file with double-click.
After reboot repeat gmer- logfile.

Am I copying this into AVZ?

[QUOTE=Rene-gad;437395]Copy follow code [SIZE="6"]into a new file[/SIZE]
[/QUOTE] 8)

New log attached.

Nothing suspicious. How does your PC doing?
Make the standard logs, pls.

Everything seems to be running great. Thanks!

New logs uploaded.

Do it once more:
- Start/Run..., copy & paste follow string:
[CODE]edit %systemroot%\system32\drivers\etc\hosts[/CODE]
press Enter, remove in the file all strings after 127.0.0.1 localhost.

File/Close/Safe changings ... [CENTER][COLOR="Red"]DON'T CLOSE THE WINDOW WITH A RED CROSS!!![/COLOR][/CENTER]
Don't use NOTHING excepted Antivirus and if you want - Firewall.
Update your version of Kaspersky.

Done and thanks again.