Abetterinternet aurora Spyware

[CorpX]

it keeps propping back!

ms anti-spyware removes it, so does spybot, but the thing pops right back up on the next restart.

i checked msconfig and i didnt see anything loading on startup that's not supposed to load up.

how do i get rid of this damn thing?

[Know Nuttin]

Post Hijackthis log file.

what you want to do is find nail.exe (should be in c:\windows)

type in the run command C:\windows\nail.exe /fullremove

delete svcproc.exe, should be in same directory as nail.exe

[pik4chu]

view my comments here http://www.ocforums.com/showthread.php?t=387016

btw, that /fullremove doesnt work.

[CorpX]

deleted nail.exe, couldnt find svcproc.exe

ill report back after next reboot

ty

[RJARRRPCGP]

You may have been infected with a rootkit. You may have been a victim of a rootkit!!! Rootkit=malware that modifies the OS kernel componentry to make the malware undetectable. By making itself a part of the OS kernel!!!

[pik4chu]

You may have been infected with a rootkit. You may have been a victim of a rootkit!!! Rootkit=malware that modifies the OS kernel componentry to make the malware undetectable. By making itself a part of the OS kernel!!!
uhhh ok.


Aurora is a shell extension which is part of what makes it so hard (read impossible) to manually remove. You basically must use programs that force deletion of files and do so after ending the explorer.exe process to keep them from respawning. And of course you must remove every single piece before rebooting or restarting explorer or it will just recreate itself. Until spyware tools have the removal correct the best bet is still the one by the creators that I linked to in the other thread. Been running clean for a whole day now and not a single popup or odd quirk, yay!