How in the *bleep* do you get rid of Aurora?

[dawsongirl]

Ugh. I've gotten rid of this thing twice and it just keeps coming back. I need a miracle cure...or a huge hammer.
:bsod:

[MsOrange]

try this:
http://www.daniweb.com/techtalkforums/thread25222.html

[Hollow]

eat it

[KJH278]

What is a Aurora

[robyrob]

Originally Posted by STEPH_McMAHON_FAN

What is a Aurora

it is spyware - a VERY nasty Hijacker. If you have it you have to remove EVERY SINGLE TRACE OF IT if you dont want it to come back.

that means clearing out all your temp files, purging your System restore and cache files, and removing ALL the files that it has left on your system and ALL of the "hooks" that it has put into your system files - not too mention that you need to restore all of your security settings afterwards, because the program deliberatly tries to open as many holes as it can for itself (or any OTHER nasties) to get back in...

follow the directions here:

http://www.geekstogo.com/forum/Auror...l_-t32046.html

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

1. I need to disable your Microsoft AntiSpyware Real-time Protection as it may interfere with the fixes.

Open Microsoft AntiSpyware.
Click on Options, Settings.
In the left pane, click on Real-time Protection.
Under Startup Options uncheck: Enable the Microsoft AntiSpyware Security Agents on startup (recommended).
Under Real-time spyware threat protection uncheck: Enable real-time spyware threat protection (recommended).
After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.

2. Download the trial version of Ewido Security Suite here:

http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

3. Please download Nailfix from here:

http://www.noidea.us/easyfile/file.p...50515010747824

. Click on Spyware Utilities
. Chose Nail/Aurora Fix

Unzip it to the desktop but please do NOT run it yet.

4. Next, reboot your computer in Safe Mode by doing the following:

A. Restart your computer
B. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
C. Instead of Windows loading as normal, a menu should appear
D. Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml

5. Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

6. Now run Ewido, and run a full scan. Save the logfile from the scan.

7. Run HijackThis, click Scan, and check:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [dzoayac] c:\windows\system32\xallynk.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

Close all open windows except for HijackThis and click Fix Checked.

8. Using Windows Explorer, locate and DELETE the following files/folders (and all their content), if they are

c:\windows\system32\xallynk.exe
C:\WINDOWS\Nail.exe

9. Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

Regards,

Trevuren

on the same page on that link above are good instructions for purging your system to make sure Aurora doesnt come back agaiin

(there is also another removal tool and instrustions here: http://kb.winantivirus.com/index.php...uestion&id=310 )

[Kazza]

What about if there's nothing on the computer called Microsoft Anti-Spyware?
Should I still run a Full system recovery after doing this or it should be sufficient?

[dawsongirl]

Well, I got my work cut out for me.

[¤I Love Clay Aiken¤]

Oh meangya. Ill save this for a rainy day.

[USTVFanFromUK]

Originally Posted by Unmarried*happy

What about if there's nothing on the computer called Microsoft Anti-Spyware?
Should I still run a Full system recovery after doing this or it should be sufficient?

You can download Microsoft Anti-Spyware.

Go here
http://www.microsoft.com/athome/secu...e/default.mspx

[robyrob]

Originally Posted by Unmarried*happy

What about if there's nothing on the computer called Microsoft Anti-Spyware?

MS Anti-Spyware is for XP only - if you have XP you should definately get it, but if you don't have it, you dont need to disable it for Aurora removal... the instructions that I pasted above were for a specific person's HijackThis log, so those specific instructions relate to his specific problem, but the general instructions are the same for Aurora removal on any computer - if you have any software that has restore or recovery functions you need to disable it because it will restore the Aurora too.

Should I still run a Full system recovery after doing this or it should be sufficient?

i'm not sure exactly what you mean by this - if you mean a System Restore in either XP or ME then NO; you need to disable your System Restore to get rid of any infected files in there.

if you are referring to System Recovery disks that came with your computer, then NO -not unless you CAN'T get rid of AURORA and just want to start over with a fresh install of Windows (which would make you lose all of your saved files unless you backup and you'd have to reinstall all of your programs)

[dawsongirl]

I couldn't run anything in safe mode because I'm on a network and it wouldn't let me sign in under safe mode. Can I still do it under regular mode okay?

[robyrob]

Originally Posted by dawsongirl

I couldn't run anything in safe mode because I'm on a network and it wouldn't let me sign in under safe mode. Can I still do it under regular mode okay?

you should really try to do it in safemode if you can - what operating system are you using? you should be able to get into safemod without logging onto the network, i think in XP you just need to change it so that you are just logging on to the computer NOT the network - it should have a dropdown box I think....

[*Miss Randomness*]

That sucks, i had a few viruses on my computer, took a while to get them all off

[dawsongirl]

Originally Posted by robyrob

you should really try to do it in safemode if you can - what operating system are you using? you should be able to get into safemod without logging onto the network, i think in XP you just need to change it so that you are just logging on to the computer NOT the network - it should have a dropdown box I think....

It's on 2000 Professional. I won't be going back to work until next Tuesday, so I'll have to try that then. I don't remember seeing a dropdown box...all I know is that when I typed in my password and pressed enter, the computer beeped and it told me I couldn't sign into the computer.

[MsOrange]

Roby, can I borrow your brain?