COMPUTER " TROJAN:Win32/Alureon.A"; or, The ROOTKIT MALWARE You Don't Even Know You Have.

http://www.microsoft.com/security ^ | Updated: Dec 16, 2009 | Microsoft

[Yosemitest]

Summary

Trojan:Win32/Alureon.A is a data-stealing trojan. This trojan allows an attacker to intercept incoming and outgoing Internet traffic in order to gather confidential information such as user names, passwords, and credit card data. Trojan:Win32/Alureon.A may also allow an attacker to transmit malicious data to the infected computer. The trojan may modify DNS settings on the host computer to enable the attacker to perform these tasks. Therefore it may be necessary to reconfigure DNS settings after Trojan:Win32/Alureon.A is removed from the computer.

Microsoft MalWare Protection Center has more info.

[Yosemitest]

I had a hard time getting rid of this problem.

Spyware Terminator detected it, and it's attempt to remove it wasn't successful.

I had to find a clean copy of "atapi.sys" and save it to my documents. Then I had to use RootRepeal and use its tools to force-wipe the infected copy of "atapi.sys" from two locations.

File: C:\WINDOWS\system32\DRIVERS\atapi.sys


Registry HKLM\SYSTEM\CurrentControlSet\Services\atapi located at

File: c:\WINDOWS\ServicePackFiles\i386\atapi.sys

After that, I copied and pasted the clean copy of "atapi.sys" into those locations and run a full scan again.

Spyware Terminator then reported:

Program: Rootkit-2660 C:\WINDOWS\system32\drivers\SET1A5.tmp Action: Auto Deny Shield: File Access shield

Process: Rootkit-2660 (Trojan Detected by ClamAV)

So, to clean this temp file out, I used CCleaner. First I changed the settings under "advanced settings" to delete ALL TEMP files, not just the ones older than 24 hours.
Then I run the cleaner. And after that, I run the registry Cleaner.

Then I scaned again with Spyware Terminator, and it came up clean.

Finally, I run Norton Ghost" and made a clean backup of my computer to an external drive.

Good luck, and I hope you don't have this Nasty RootKit.

[taxcontrol]

It does not show up on my Linux box

[DontTreadOnMe2009]

Wow

What a project!

Sorry to say it but ,,, get a Mac.

And tell Bill Gates where to get off with his POS DOS system from the 90s that he refuses to bring into the modern world.

[HiTech RedNeck]

hoo boy, stealing your DNS gives virtual carte blanche to the haxors.

[EdReform]

BTTT. Thanks for posting!

[HiTech RedNeck]

Which Windows. XP? Vista? 7?

[wireplay]

Windows is not based on DOS. At least if you are going to trash Windows, get some facts. Windows hasn’t been DOS based in over a decade.

[driftdiver]

Yeah get a mac and get an OS from the 70s

[wireplay]

And, btw, I can write a malware program that hits Macs or Linux. Why? Because most malware relies on a user clicking on “Sure! I want to install this!”. There is no stopping this breach.

The easiest way to get passwords for systems is to dumpster dive or get into offices after hours. Look under keyboards, in drawers, etc. where people write them down. Security if often not connected with the O/S but with people not taking precautions.

Basically, trashing Windows buys little. Linux is wide-open compared to z/OS. Those both are wide-open compared to a closed system that never connects to the net.

[driftdiver]

but but but mac has NEVER had a self propagating virus!! really it hasn’t. That must mean its secure.

[truthguy]

read later

[Rammer]

ping

[wireplay]

Mac users are clueless about the threat fro malware writers. If Macs ever get a foothold, they will find out.

I started my career coding in Macs and I have never seen them gain any marketshare because they do not address business needs.

The Mac folks also do not understand computing worth a poop. Apple finally gave up the ghost and switched to Unix and hoped for the best. I have coded on MVS, Unix, and Windows. Nothing compares to Windows in ease of use, hence that is where everything is built. Unix is nice, MVS is sweet (but simple).

How hard would it be for me to write a malware app that asks a user for their username and password then https that unencrypted password out to my web service for harvesting? We can actually throw an event for every keystroke and capture the whole session easily. The mac folks think this is not possible and their O/S protects them from it when it has nothing whatsoever to do with the O/S. A user clicks Ok and their system is mine.

[HiTech RedNeck]

Which was designed from the get-go for multiple hostile users, not one friendly user.

[HiTech RedNeck]

There are still enough Macs and Linuxes that an amphibious or cross system vectoring malware could grab hold right now if it was anywhere close to as easy to get into the Macs and Linuxes as it is to get into most existing Windows installation.

[bmwcyle]

bttt

[wireplay]

Viruses are what they are but the threat isn’t there. It is in malware and a user will introduce it w/o even breaking a sweat.

Windows is secure on the latest versions but malware is the game.

“Look! A free copy of Tetris for my Mac!!!! All it does is ask me for a username and password!”

Bingo. Test the uid/password on Quicken, Wells Fargo, Chase, etc.

People get their panties in a wad over a DOS attack. The threat is monetary.

[wireplay]

BTW, as a computer guy you should know that Windows of today is based on VMS.

My guess is that the original poster is not running a modern Windows variant or did the click and hope for the best method of implementation.

I do not buy this widespread virus spread we saw in the past (which was a problem, I agree).

[vanilla swirl]

“It does not show up on my Linux box’

nor mine ;-)

[Brad’s Gramma]

Me too....