Home Malware Programs Trojans Trojan:dos/alureon.dx

Trojan:dos/alureon.dx

Posted: August 11, 2011

Trojan:dos/alureon.dx is a Trojan horse that's strongly-associated with rootkit infections. Because these infections may have multiple components besides Trojan:dos/alureon.dx, using extremely sophisticated security or anti-malware software may be the only way to remove Trojan:dos/alureon.dx and prevent Trojan:dos/alureon.dx from being reinstalled by the original rootkit. SpywareRemove.com malware researchers stress the danger inherent in Trojan:dos/alureon.dx as a severe risk to your computer's security, but Trojan:dos/alureon.dx may also use other attacks that are unrelated to blocking security programs or features, such as hijacking your web browser, installing other malicious software or using keylogging functions to steal private information.

Trojan:dos/alureon.dx - the Little Brother of a Big Bad Rootkit

SpywareRemove.com malware researchers have found that almost all Trojan:dos/alureon.dx infections involve prior infection with other Trojans and rootkits, especially rootkits that infect the Master Boot Record (abbreviated as the MBR). Since casual scans will avoid checking the MBR, no matter how many times you delete Trojan:dos/alureon.dx, Trojan:dos/alureon.dx typically will be reinstalled until you finish removing all of Trojan:dos/alureon.dx's related infections in a clean sweep.

Some major rootkits that may use Trojan:dos/alureon.dx components or related Trojans include TDSS.d!men, TDSS Rootkit, TDSS.e!rootkit, TDL3 Rootkit and Rootkit.Win32.Agent.bhnc. Such rootkits are known to use Trojan:dos/alureon.dx and other Trojan components to attack your computer's security features and programs. Standard warning signs of such attacks can consist of:

  • An inability to access crucial programs such as Task Manager or a popular anti-virus scanner.
  • Disabled or completely nonfunctional security features that should be active and functional such as Windows Update.
  • Setting alterations that take place without your permission and refuse to be undone, particularly opened network ports and exceptions that are added to the Windows Firewall.
  • The presence of programs that you haven't installed willingly, particularly Remote Administration Tools or RATs.

All of these types of attacks are used to make your PC vulnerable to other attacks that can be made by Trojan:dos/alureon.dx, another rootkit component or even a remote criminal. The installation of spyware, such as Trojan-Spy.Win32.VB.cfj, Trojan-Spy.Win32.Zbot.bfur, Trojan-Spy.Win32.Dibik.fnz or Trojan-Spy.Win32.Zbot.aqzk is also common. Trojan:dos/alureon.dx is also strongly linked to Trojan:dos/alureon.a, which may also be present regardless of what other attacks are made.

How to Deal with Trojan:dos/alureon.dx and Its Domineering Family of Rootkits

You should never try to remove Trojan:dos/alureon.dx without the help of advanced security software unless there are no other options available. Improper removal of Trojan:dos/alureon.dx and related infections can damage the Windows Registry, the Master Boot Record and other Windows components that could cause the system to become inoperable. Instead of risking such a disastrous crash and burn operation, using a properly-sophisticated anti-malware scanner can remove Trojan:dos/alureon.dx and any other rootkit components that may be with Trojan:dos/alureon.dx.

SpywareRemove.com malware experts recommend operating from within Safe Mode while removing Trojan:dos/alureon.dx, since anything other than that will grant Trojan:dos/alureon.dx and related Trojans additional opportunities to assert themselves into your startup routine. SpywareRemove.com malware researchers also recommend using the most advanced scanning procedures that are available for your choice of anti-malware program, since quick or simplistic scanning features may skip the Master Boot Record and, therefore, allow Trojan:dos/alureon.dx to be reinstalled at a later time.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%Documents and Settings%\[UserName]\Local Settings\Application Data\[RANDOM CHARACTERS].exe" -a "%Program Files%\Internet Explorer\iexplore.exe"'HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%Documents and Settings%\[UserName]\Local Settings\Application Data\[random].exe" -a "%Program Files%\Mozilla Firefox\firefox.exe"'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\random.exe
Loading...