Alureon

Alureon is a subgroup of rootkits and Trojans that often consist of multiple components and use sophisticated techniques to steal private information (such as online bank data or account passwords). Specific members of the Alureon gang include the TDL4 rootkit, TDL3 rootkit, Win32/Alureon, Rootkit.Win32.TDSS.bj, Trojan.Win32.Menti.hvdp and TDSS rootkit, all of which have advanced features to evade detection and cripple your computer's security functions. SpywareRemove.com malware analysts have noted that attacks by Alureon rootkits have also acquired infamy by installing additional types of malicious software and by redirecting web browsers to harmful websites. Because Trojans and rootkits from the Alureon family are notoriously-difficult to find or delete, it's strongly recommended that you use powerful anti-malware software to remove Alureon from your PC if you think that you have an Alureon infection.

Alureon – A Complex but Powerful Plan to Bilk Your PC Out of Everything

Direct symptoms of Alureon activities are a rare occurrence, since Alureon, like all Trojans and rootkits, will take steps to hide itself from ready detection. However, you may be able to notice Alureon due to unusual network activity, malfunctions in security software or browser redirect attacks. Alureon infections are often composed of multiple components, including a 'dropper' Trojan that installs the rest of the Alureon rootkit, as well as a 'payload' Trojan that coordinates Alureon's attacks. Typical Alureon-related risks that SpywareRemove.com malware analysts have found include:

• The installation of other forms of harmful software with varying degrees of visibility. Some programs, such as rogue security applications, may be very visible, while others, such as keyloggers, may be difficult or impossible to detect without some form of anti-malware program.
• Browser hijacks that redirect your online searches to unusual websites. Websites that are promoted by Alureon are, of course, utterly unsafe for your PC, even if they might appear to be a trustworthy search engine or software website.
• Loss of personal information due to spyware-related activities that Alureon may be configured to use against your PC. This can include taking screenshots, keylogging and even recording webcam data.
• Infection of Internet Explorer processes.
• The inclusion of a DNSChanger component that attacks your Domain Name Server settings. This allows Alureon to intercept information that you send through the Internet (or receive from it).

Other attacks may also vary, depending on the variant of Alureon as well as any instructions that Alureon receives from an outside command server.

How to Get Rid of Alureon and Insure That It will not Be Back

Improper removal of Alureon can easily allow Alureon to regenerate itself and resume its attacks. SpywareRemove.com malware researchers have noted that the most common way for this to occur is for Alureon to restore itself from an infected system backup file. If you find it necessary to replace damaged Windows components, it's recommended that you reinstall the files from a clean source instead of trying to restore them from an on-board backup.

New versions of Alureon rootkits have also been found to corrupt certain drivers to the point of making them unusable; common Alureon victims include atapi.sys, iastorv.sys, idechndr.sys, nvata.sys, nvstor.sys, nvstor32.sys, nvatabus.sys, nvgts.sys, iastor.sys and sisraid.sys. As noted above, the standard precaution against using backups still applies. You may also need to restore other types of system settings, such as your DNS settings, from any changes that Alureon may have made. Failure to do this, even after you've deleted Alureon, may result in exposure to sites that reinfect your PC with Alureon or related PC threats.

Technical Details