Aurora: Adware From Heck. Help me.. somebody

[djwacko 0]

Ok.. so here's the problem:I have been getting lots and lots of pop-ups from this program called Aurora. Everytime my spyware blocker asks if i want to block it, i pick 'yes.' Then, my spyware blocker pops up again and says that it has changed and asks if i want to still block it. So, I pick 'yes' again. After doing this a gibazillion times, I went and downloaded Microsoft AntiSpyWare (which is very good...so far) and everytime i run a scan, it finds Aurora, and deletes it. Then, in a matter of minutes, Aurora comes back.Can anyone help me?

[Klass 0]

Obviosly Microsoft Anti-Spyware is not working for you, I would suggest installing others as well as keep microsoft Antispyware.

I would download and run these programs listed here:
http://forums.xisto.com/topic/84093-topic/?findpost=1064304790

Install, Update, Scan. Definatly do the free ones. After you run them once, reboot, run them again, Reboot (fingers crossed) the issues should be gone.

[finaldesign1405241487 0]

well seems to me you are having some advanced spyware problem. But lucky for you solutions is simple anyway let's get started... That aurora is running from somewhere, you just need to find out from where... When that antispyware program finds it... just look carefully when it is deleted: its filename, and where it is. Then start some regedit program (a program RegCleaner is pretty good) then when you get that program (try at download.com) look into startup programs that look suspicious... and delete them (don't worry everything is reversible if you delete something by accident.) Anyway you must find corresponding program, that runs aurora anytime it founds that is deleted... probably there is 2 copys of aurora, one running, and the other one running at system startup and checking is there original running or not, then if is not running it copies itself again an runs. That way you cant delete it if you dont find a source program. Kind a tricky but hey, it's only way if antispyware can't find it...

[miCRoSCoPiC^eaRthLinG 0]

You might also check out some first hand information about this particularly nasty spyware:

 

1. Aurora.Com

2. Aurora Process Information

3. Also check this thread about this same spyware on Aluria Spyware Eliminator forums: http://forums.xisto.com/no_longer_exists/

 

According to these pages, the .exe file is usually named nail.exe and lurks around your Windows directory.

 

Regards,

m^e

[Jeigh1405241495 0]

If you feel confident you won't be screwing your system up over the next couple hours, try turning off system restore and then scanning/cleaning the spyware. I've had viruses/adware/spyware hide in my system restore folder before and not get deleted as the restore files are often ignored by cleaners since they are used to FIX potential problems caused by programs, thus affecting them with programs would be counter productive...After running the scans turning system restore back on (assuming u had it on in the first place) would be a good idea so u dont break something then get pissed that u turned it off

[Logan Deathbringer 0]

The best way I found to deal with spyware was to use a program called Spybot search and destroy. Even in the rare occurance that it can't remove spyware it has the ability to show you what is being run at startup and if it is a malitious startup program SB S&D know about it and highlights the startup command in red. The program also has quite a few other features you might find handy in the fight againsts spyware and malware

[IWroteCode 0]

Just like Logan, I highly recommend Spybot Search & Destroy. It has been the best freeware I have ever downloaded, saving my pc from reformatting the hd multiple times. It also includes a program called TeaTimer which monitors your registry in realtime and warns (and lets you allow/disallow) when the registry is changed. You can get them here. (1 download)

[TheJeffsta 0]

I had a mass break out of that damn annoying spyware on my computer. I still have 1 bit of it left that Ad-Aware and Spybot cannoy get rid of for some reason (registry key). Its a nasty one. Most spyware scanners can get rid of it, try scanning in Safe Mode or when it cant remove some threat, allow it to run on windows startup.

[WeaponX 0]

I'm not sure on the rules here regarding log files. Some of these logs can get pretty big and I don't want the Moderators to think this is a form of cheating for the points system.

So if you want, I suggest directing this question to my forum instead. I have a forum setup to deal with spyware. This one is not an easy one to remove if you don't have the proper tools. And no, Spybot and other spyware removal programs can NOT remove this little critter. It will pop right back.

Go here and follow the steps outlined there. If you did a step already, just skip it and move on to the next one. When ready, post the HijackThis log in my forum (unless it's ok with the moderators to post them here?).