Re: Aurora

[David H. Lipman]

"Anti spyware" <patrick@nguyenweb.net> wrote in message
news:bwY7e.7121$An2.6756@newsread2.news.pas.earthl ink.net
| I have been trying ot clean out this popup for ever now, the title bar title
| is Aurora. I have tried adware and microsoft spyware beta, in both normal
| windows and safe mode. I still havent had any luck yet. I did searches in
| the registry and system drives for the word aur and aurora and still no luck
| at all. it stops for a few hours then its back again after i run the
| removers in safe mode. Any comments or help would be appriciated, since i
| cant find any real help through googles nor the forum search. here is my
| hijack log..
|
| Heres a print screen:
|

< HJT log snipped >

This is a discussion group. It is NOT a binaries group. Please do not post attachments.

Please read the News Group FAQ.

News Groups that start with the name; alt.binaries.* allow posting attachments. Those that
don't have the word binaries in the name don't allow posting attachments in the alt.*
hierarchy.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Anti spyware]

Sorry wont do that again.

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:89Z7e.16323$Xm3.10826@trndny01...
> "Anti spyware" <patrick@nguyenweb.net> wrote in message
> news:bwY7e.7121$An2.6756@newsread2.news.pas.earthl ink.net
> | I have been trying ot clean out this popup for ever now, the title bar
> title
> | is Aurora. I have tried adware and microsoft spyware beta, in both
> normal
> | windows and safe mode. I still havent had any luck yet. I did searches
> in
> | the registry and system drives for the word aur and aurora and still no
> luck
> | at all. it stops for a few hours then its back again after i run the
> | removers in safe mode. Any comments or help would be appriciated, since
> i
> | cant find any real help through googles nor the forum search. here is my
> | hijack log..
> |
> | Heres a print screen:
> |
>
> < HJT log snipped >
>
> This is a discussion group. It is NOT a binaries group. Please do not
> post attachments.
>
> Please read the News Group FAQ.
>
> News Groups that start with the name; alt.binaries.* allow posting
> attachments. Those that
> don't have the word binaries in the name don't allow posting attachments
> in the alt.*
> hierarchy.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

[David H. Lipman]

"Anti spyware" <patrick@nguyenweb.net> wrote in message
news:6678e.7135$yq6.5543@newsread3.news.pas.earthl ink.net
| Sorry wont do that again.
|

In the future just write your message in this News Group or in an anti virus News Group and
post your attachment in; alt.binaries.comp.virus
then in your text here point to the attachment posted there.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Mich]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:89Z7e.16323$Xm3.10826@trndny01...
> "Anti spyware" <patrick@nguyenweb.net> wrote in message
> news:bwY7e.7121$An2.6756@newsread2.news.pas.earthl ink.net
> | I have been trying ot clean out this popup for ever now, the title bar
title
> | is Aurora. I have tried adware and microsoft spyware beta, in both
normal
> | windows and safe mode. I still havent had any luck yet. I did searches
in
> | the registry and system drives for the word aur and aurora and still no
luck
> | at all. it stops for a few hours then its back again after i run the
> | removers in safe mode. Any comments or help would be appriciated, since
i
> | cant find any real help through googles nor the forum search. here is my
> | hijack log..
> |
> | Heres a print screen:
> |
>
> < HJT log snipped >
>
> This is a discussion group. It is NOT a binaries group. Please do not
post attachments.
>
> Please read the News Group FAQ.
>
> News Groups that start with the name; alt.binaries.* allow posting
attachments. Those that
> don't have the word binaries in the name don't allow posting attachments
in the alt.*
> hierarchy.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

Sorry David but I gotta say this ...you are more anal retentive than me ...
and that is way bad dude..................... get a life.
Way to harsh !!!
Mich..

[David H. Lipman]

"Mich" <Mich8hb@netscape.net> wrote in message news:RMj8e.17734$Xm3.5985@trndny01
|
| Sorry David but I gotta say this ...you are more anal retentive than me ...
| and that is way bad dude..................... get a life.
| Way to harsh !!!
| Mich..

Factual - Yes.
Harsh - No.

Harsh would be to call the OP all sorts of fowl words. I posted the facts and only the
facts.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Anti spyware]

Okay, i have tried to clean it out with Hijackthis (service) and did a
removal of the nail.exe and nail***.pf. It still keeps showing up. I
decided to delete the files and hurried up and created a file with the same
name in the directory, so it cant be created by the malware. Seems to be
working so far. I will keep you up to date.

BTW: i cleaned everything in the registry that had nail, svcproc, and
aurora.
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:EHk8e.17742$Xm3.7100@trndny01...
> "Mich" <Mich8hb@netscape.net> wrote in message
> news:RMj8e.17734$Xm3.5985@trndny01
> |
> | Sorry David but I gotta say this ...you are more anal retentive than me
> ...
> | and that is way bad dude..................... get a life.
> | Way to harsh !!!
> | Mich..
>
> Factual - Yes.
> Harsh - No.
>
> Harsh would be to call the OP all sorts of fowl words. I posted the facts
> and only the
> facts.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

[Mich]

"Anti spyware" <patrick@nguyenweb.net> wrote in message
news:E_v8e.9752$lP1.6995@newsread1.news.pas.earthl ink.net...
> Okay, i have tried to clean it out with Hijackthis (service) and did a
> removal of the nail.exe and nail***.pf. It still keeps showing up. I
> decided to delete the files and hurried up and created a file with the
same
> name in the directory, so it cant be created by the malware. Seems to be
> working so far. I will keep you up to date.
>
**************

In the hijack log look for something that is loading as a Winlogon ?
A .DLL file it is probably reinstalling the malware.
look at the Hijackthis log and do an "info on selected item" and look for
something that says loads very early at startup. (something like that).

The idea of creating an "empty" file with the same name is something I never
thought of !
Genius !!!!!!!!!!!!

Mich...









> BTW: i cleaned everything in the registry that had nail, svcproc, and
> aurora.
> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
> news:EHk8e.17742$Xm3.7100@trndny01...
> > "Mich" <Mich8hb@netscape.net> wrote in message
> > news:RMj8e.17734$Xm3.5985@trndny01
> > |
> > | Sorry David but I gotta say this ...you are more anal retentive than
me
> > ...
> > | and that is way bad dude..................... get a life.
> > | Way to harsh !!!
> > | Mich..
> >
> > Factual - Yes.
> > Harsh - No.
> >
> > Harsh would be to call the OP all sorts of fowl words. I posted the
facts
> > and only the
> > facts.
> >
> > --
> > Dave
> > http://www.claymania.com/removal-trojan-adware.html
> > http://www.ik-cs.com/got-a-virus.htm
> >
> >
>
>