Trojan:Win32/Alureon.CT is a trojan that may send system information to a remote address.
For more information refer to the description for the Win32/Alureon family.

What to do now

To detect and remove this threat and other malicious software that may be installed in your computer, run a full-system scan with an up-to-date antivirus product such as the following:
For more information on antivirus software, see
Restoring Corrupted Files
In some instances, Alureon may modify certain driver files such that they become corrupted and unusable. These corrupted files that will NOT be restored by detecting and removing this threat. In order to restore functionality to the computer, the corrupted file must be restored from backup. Users are advised to boot into a recovery environment and manually replace the file with a clean copy.
Restoring DNS Settings
The Domain Name System (DNS) is used (among other things) to map domain names to IP addresses - that is, to map human-readable domain names to machine-readable IP addresses. When a user attempts to visit a particular URL, a browser will use DNS servers to find the correct IP address of the requested domain. When a user is directed to a malicious server that is not part of the authoritative Domain Name System, an attacker can provide incorrect IP addresses at their choice to map to particular domain names, thus directing the user to possibly bogus or malicious sites without the affected user's knowledge.
Win32/Alureon may modify DNS settings on the host computer, thus the following steps may be required after the Win32/Alureon removal is complete:
  • If the computer has a network interface that does not receive a configuration using DHCP, reset the DNS configuration if necessary. For information on configuring TCP/IP to use DNS in Windows XP, see
  • If a dial-up connection is sometimes used from the computer, reconfigure the dial-up settings in the rasphone.pbk file as necessary, as Win32/Alureon may set the fields "IpDnsAddress" and "IpDns2Address" in the rasphone.pbk file to the attacker's address. The Microsoft scanner code that automatically removes Win32/Alureon backs up the infected dial-up configuration file to:
    %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\rasphone.pbk.bak

Threat behavior

Trojan:Win32/Alureon.CT is a member of Win32/Alureon - a multi-component family of trojans involved in a broad range of subversive activities online that generate revenue from various sources for its controllers. Mostly, Win32/Alureon is associated with moderating affected user's activities online to the attacker's benefit. As such, the various components of this family have been used for:
  • modifying the affected user's search results (search hijacking)
  • redirecting the affected user's browsing to sites of the attacker's choice (browser hijacking)
  • hanging DNS settings to redirect users to sites of the attacker's choice without the affected user's knowledge
  • downloading and executing arbitrary files, including additional components and other malware
  • serving illegitimate advertising
  • installing rogue security software
  • banner clicking

Win32/Alureon also uses advanced stealth techniques to hinder the detection and removal of its various components.
Some variants of this trojan may modify DNS settings on the host computer to enable the attacker to perform these tasks. Therefore it may be necessary to reconfigure DNS settings after the trojan is removed from the computer.
Trojan:Win32/Alureon.CT is a trojan that may send system information to a remote address.
Trojan:Win32/Alureon.BE may be downloaded or dropped by other members of the Alureon family. It is usually installed or dropped in the following location:
<system folder>\spool\PRTPROCS\W32X86\<random letter or number>.tmp
For example:
It injects its code into the legitimate process 'spoolsv.exe'.
Drops other malware
Trojan:Win32/Alureon.CT drops the following file:
%Temp%\<random letter or number>.tmp (for example, F.tmp) - this file is detected as Trojan:WinNT/Alureon.G
It creates the following registry entry to enable its dropped file to run as a service:
Adds value: "Image Path"
With data: "%Temp%\<random number or letter>.tmp"
In subkey: HKLM\System\Currentcontrolset\Services\tdlserv
It may also drop other files in the system as:
tdlcmd.dll - detected also as Trojan:Win32/Alureon.CT
tdlwsp.dll - detected as Trojan:Win32/Alureon.gen!U
config.ini - contains malware information
Connects to remote servers
Trojan:Win32/Alureon.CT may connect to the following remote servers and IP address:
It may then send information about the infected system to these servers.
Analysis by Tim Liu


There are no common symptoms associated with this threat. Alert notifications from installed antivirus software may be the only symptom(s).


Alert level: Severe
First detected by definition: 1.67.549.0
Latest detected by definition: 1.207.1041.0 and higher
First detected on: Oct 08, 2009
This entry was first published on: Oct 23, 2009
This entry was updated on: Apr 17, 2011

This threat is also detected as:
  • Win32/Tidserv.H (CA)
  • Packed.Win32.Tdss.w (Kaspersky)
  • W32/DNSChanger.FUBV (Norman)
  • Trojan.Tdss.HWD (VirusBuster)
  • DNSChanger!bc (McAfee)
  • Backdoor.Tidserv (Symantec)