Tech Support Forum - View Single Post - Please help me remove the aurora nail.exe spyware...logfile included.

tetonbob · 08-24-2005, 02:43 PM

Copy these instructions to Notepad

Download Killbox from one of these locations:

http://www.greyknight17.com/spy/KillBox.exe
http://www.downloads.subratam.org/KillBox.zip
http://www.atribune.org/downloads/KillBox.exe

Run KILL box. Paste the following locations into KILL BOX one at a time. Checkmark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot.

C:\WINDOWS\SYSTEM32\cache32dsrf4535dfs
C:\WINDOWS\system32\AddQuit.ico
C:\WINDOWS\system32\Desktop.ico
C:\WINDOWS\system32\Help.ico
C:\WINDOWS\system32\IE.ico
C:\WINDOWS\system32\Open.ico
C:\WINDOWS\system32\Quick.ico
C:\WINDOWS\system32\Uninstall.ico

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.

Delete the following folder:

C:\DOCUMENTS AND SETTINGS\MIKE MACE\FAVORITES\1111

Restart your system into normal Windows.

Now run FindIt's and Panda ActiveScan again, and post the logs here. Also, please post a fresh HJT log.

08-24-2005, 02:43 PM	#6 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,795 OS: 2000 Pro; XP Pro; XP Home	Copy these instructions to Notepad Download Killbox from one of these locations: http://www.greyknight17.com/spy/KillBox.exe http://www.downloads.subratam.org/KillBox.zip http://www.atribune.org/downloads/KillBox.exe Run KILL box. Paste the following locations into KILL BOX one at a time. Checkmark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. C:\WINDOWS\SYSTEM32\cache32dsrf4535dfs C:\WINDOWS\system32\AddQuit.ico C:\WINDOWS\system32\Desktop.ico C:\WINDOWS\system32\Help.ico C:\WINDOWS\system32\IE.ico C:\WINDOWS\system32\Open.ico C:\WINDOWS\system32\Quick.ico C:\WINDOWS\system32\Uninstall.ico If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again. Delete the following folder: C:\DOCUMENTS AND SETTINGS\MIKE MACE\FAVORITES\1111 Restart your system into normal Windows. Now run FindIt's and Panda ActiveScan again, and post the logs here. Also, please post a fresh HJT log. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009 Last edited by tetonbob; 08-24-2005 at 02:46 PM.