"Anti spyware" <patrick@nguyenweb.net> wrote in message
news:E_v8e.9752$lP1.6995@newsread1.news.pas.earthl ink.net...
> Okay, i have tried to clean it out with Hijackthis (service) and did a
> removal of the nail.exe and nail***.pf. It still keeps showing up. I
> decided to delete the files and hurried up and created a file with the
same
> name in the directory, so it cant be created by the malware. Seems to be
> working so far. I will keep you up to date.
>
**************

In the hijack log look for something that is loading as a Winlogon ?
A .DLL file it is probably reinstalling the malware.
look at the Hijackthis log and do an "info on selected item" and look for
something that says loads very early at startup. (something like that).

The idea of creating an "empty" file with the same name is something I never
thought of !
Genius !!!!!!!!!!!!

Mich...









> BTW: i cleaned everything in the registry that had nail, svcproc, and
> aurora.
> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
> news:EHk8e.17742$Xm3.7100@trndny01...
> > "Mich" <Mich8hb@netscape.net> wrote in message
> > news:RMj8e.17734$Xm3.5985@trndny01
> > |
> > | Sorry David but I gotta say this ...you are more anal retentive than
me
> > ...
> > | and that is way bad dude..................... get a life.
> > | Way to harsh !!!
> > | Mich..
> >
> > Factual - Yes.
> > Harsh - No.
> >
> > Harsh would be to call the OP all sorts of fowl words. I posted the
facts
> > and only the
> > facts.
> >
> > --
> > Dave
> > http://www.claymania.com/removal-trojan-adware.html
> > http://www.ik-cs.com/got-a-virus.htm
> >
> >
>
>