Well, removal of this bot is trivial. You can do it without any additional tools. Just taskmanager, explorer and regedit (or Process Explorer, Process Monitor and Autoruns if you want to do this quick).
Autorun entry located in HKCU\Software\Microsoft\Windows\CurrentVersion\Run
File stored in %ALLUSERSPROFILE%\AppData, e.g. C:\Documents and Settings\All Users\Application Data\dbadacbbesacfsfdsf.exe
While work this Alureon injects itself into explorer.exe address space using Shell_TrayWnd trick or by NtQueueApcThread. This injected code running payload thread (thread id can be determined with ProcMon), that overwrites malware binary on disk every second as a part of antiremoval (same for registry key).
Variant A
1) Terminate explorer.exe with taskmanager;
2) Restart it from taskmanager, injected code still in newly created explorer? Do not worry, this is because of shared section trick this malware previously used. Even if this code is inside new explorer it is not executed;
3) Remove file, remove registry key.
Variant B
1) Determine Alureon payload thread with Process Monitor (filter by Explorer.exe, Disk I/O activity, also at call Stack page you can reveal memory address in Explorer VA space where Alureon sits);
2) Terminate this thread by Process Explorer;
3) Remove file, remove registry key (Autoruns).
Run full AV scan, as it can be more malware downloaded by this bot.
Ring0 - the source of inspiration
