Jump to content
xisto Community
Sign in to follow this  
djwacko

Aurora: Adware From Heck. Help me.. somebody

Recommended Posts

Ok.. so here's the problem:I have been getting lots and lots of pop-ups from this program called Aurora. Everytime my spyware blocker asks if i want to block it, i pick 'yes.' Then, my spyware blocker pops up again and says that it has changed and asks if i want to still block it. So, I pick 'yes' again. After doing this a gibazillion times, I went and downloaded Microsoft AntiSpyWare (which is very good...so far) and everytime i run a scan, it finds Aurora, and deletes it. Then, in a matter of minutes, Aurora comes back.Can anyone help me?

Share this post


Link to post
Share on other sites

Obviosly Microsoft Anti-Spyware is not working for you, I would suggest installing others as well as keep microsoft Antispyware.

I would download and run these programs listed here:
http://forums.xisto.com/topic/84093-topic/?findpost=1064304790

Install, Update, Scan. Definatly do the free ones. After you run them once, reboot, run them again, Reboot (fingers crossed) the issues should be gone.

Share this post


Link to post
Share on other sites

well seems to me you are having some advanced spyware problem. But lucky for you solutions is simple :lol: anyway let's get started... That aurora is running from somewhere, you just need to find out from where... When that antispyware program finds it... just look carefully when it is deleted: its filename, and where it is. Then start some regedit program (a program RegCleaner is pretty good) then when you get that program (try at download.com) look into startup programs that look suspicious... and delete them (don't worry everything is reversible if you delete something by accident.) Anyway you must find corresponding program, that runs aurora anytime it founds that is deleted... probably there is 2 copys of aurora, one running, and the other one running at system startup and checking is there original running or not, then if is not running it copies itself again an runs. That way you cant delete it if you dont find a source program. Kind a tricky but hey, it's only way if antispyware can't find it...

Share this post


Link to post
Share on other sites

You might also check out some first hand information about this particularly nasty spyware:

 

1. Aurora.Com

2. Aurora Process Information

3. Also check this thread about this same spyware on Aluria Spyware Eliminator forums: http://forums.xisto.com/no_longer_exists/

 

According to these pages, the .exe file is usually named nail.exe and lurks around your Windows directory.

 

Regards,

m^e

Share this post


Link to post
Share on other sites

If you feel confident you won't be screwing your system up over the next couple hours, try turning off system restore and then scanning/cleaning the spyware. I've had viruses/adware/spyware hide in my system restore folder before and not get deleted as the restore files are often ignored by cleaners since they are used to FIX potential problems caused by programs, thus affecting them with programs would be counter productive...After running the scans turning system restore back on (assuming u had it on in the first place) would be a good idea so u dont break something then get pissed that u turned it off

Share this post


Link to post
Share on other sites

The best way I found to deal with spyware was to use a program called Spybot search and destroy. Even in the rare occurance that it can't remove spyware it has the ability to show you what is being run at startup and if it is a malitious startup program SB S&D know about it and highlights the startup command in red. The program also has quite a few other features you might find handy in the fight againsts spyware and malware

Share this post


Link to post
Share on other sites

Just like Logan, I highly recommend Spybot Search & Destroy. It has been the best freeware I have ever downloaded, saving my pc from reformatting the hd multiple times. It also includes a program called TeaTimer which monitors your registry in realtime and warns (and lets you allow/disallow) when the registry is changed. You can get them here. (1 download)

Share this post


Link to post
Share on other sites

I had a mass break out of that damn annoying spyware on my computer. I still have 1 bit of it left that Ad-Aware and Spybot cannoy get rid of for some reason (registry key). Its a nasty one. Most spyware scanners can get rid of it, try scanning in Safe Mode or when it cant remove some threat, allow it to run on windows startup.

Share this post


Link to post
Share on other sites

I'm not sure on the rules here regarding log files. Some of these logs can get pretty big and I don't want the Moderators to think this is a form of cheating for the points system.

So if you want, I suggest directing this question to my forum instead. I have a forum setup to deal with spyware. This one is not an easy one to remove if you don't have the proper tools. And no, Spybot and other spyware removal programs can NOT remove this little critter. It will pop right back.

Go here and follow the steps outlined there. If you did a step already, just skip it and move on to the next one. When ready, post the HijackThis log in my forum (unless it's ok with the moderators to post them here?).

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×
×
  • Create New...

Important Information

Terms of Use | Privacy Policy | Guidelines | We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.