BleepingComputer.com: Aurora Fix

Hey All,

I, too, had the Aurora Trojan. I ran repeated scans and even spent over an hour on the phone with two different techs at Microsoft, who appeared equally as stumped. Nothing they suggested helped; Aurora was popping up several ads at a time.

I finally brought my computer -- a four-year-old Compac Presario laptop -- over to a good friend; a real computer wiz, who suggested that the only sure way to get rid of Aurora was to reinstall my Windows XP operating system.

Fortunately, I still had my installation CD's. First, however, I had to back up everything essential in my Documents, as well as some key operating systems.

We installed the three XP CD's. Then reinstalled Norton Internet Security. Next, I got on line at Microsoft and spent 3-4 hours receiving and installing Windows Updates. This, of course, was very important because the CD's are over four years old.

After that was done, I deframented my computer (as my friend suggested) and ran a full system Norton scan.

When I got back on line, *ta-daaa!* no more Aurora. Of course then I had to transfer all my essential documents and programs back onto my hard drive, which took additional time. Small price to pay, though, for all the aggravation that Aurora was causing.

It's been four days now since I did all this, and not *one* Auroroa pop-up.

Hope this helps someone in the same boat.

Bil Sullivan

www.WhoAreYou.ws

Mod Edit: Email address edited out to protect against SpamBots

Though I appreciate your heads up, what you say is not entirely accurate. It is true that the infection is very difficult to remove but the malware removal community has found ways of removing it. Ewido security suite does a good job removing the majority of the infection. Then using killbox you can generally remove the last piece.

While reinstalling the OS will definitely get rid of any malware problems, it is possible to remove aurora without reinstalling.

Grinler, on May 6 2005, 04:38 PM, said:

But for many, reformat is easiest, especielly for those who are not so good with computers, they can't bother sit down a few hours or something to get rid of it, so they just reformat - I have to agree with that backup part, it's a pain in the ass to take backup of everything

Quite honestly, i think a reformat is more difficult and time consuming than posting a hjt log and getting help. Our turn around is usually about 1 day on hjt logs.

People think in diffrent ways, For me reformating isnt difficult and I'm pretty sure its like this for everyone;

1- Reboot, tap F12 or whatever it was
2- Put in CD
3- Delete partionen (Spell?)
4- Install new one
5- The rest will be automaticly until some place where you have put in some info

It usully wont take more than 1-1:30 hours for reformating to finish, but people think diffrent as I said, someone think reformating is easier, someone think fixing it is easier (Fixing it in meaning of with HTJ and virus scans etc, )

I can go both ways, and the determining factors are these:

1. Have I backuped up my recently added data?
2. Do I have any improvements in mind to employ, like a different partition arrangement or different way to reload my data for possibly better organization?
3. I do a lot of online research, are my bookmarks organized and have I saved a copy of that folder?
4. Do I have my driver(s) updates in addition to my original system drivers CD ?
5. I have winXP, and the SP2 CD, but 19 updates since then... have I made a slipstream CD to use? (no, not yet) Am I willing to take the time to update?
6. My programs, the download files & CDs are available? (yes) ... but, many also need updates since I originally downloaded/installed them, all the anti-this and thats & even the alternative browser/email client will likely need updating.
7. Are there any OS issues that might clear up with a re-installation in addition to the malware problem?

If I can answer yes and/or do the updates to them all, then ... a reformat is handy to do. I can run HJT effectively, however, so it is always an option.

I think the bottomline is to know your options, use either when it is appropriate.
I've found the winOS itself can stumble without malware all by itself, and develop bad behavior on it's own. Malware can really provoke annoying actions, too.

Sometimes the combination is more than guided fixes can easily remedy effectively,
but Grinler makes a good point ... fixes are designed to rid the malware independently of the need to reformat and can be accomplished within a short period of time, especially when the user does understand the options fully.

Whether you use a homebuilt "clone" or the "ready-mades" and their "recovery" techniques, practice using the safeguards that are taught.

1. Backup your data by habit.
2. Know where you stand with updates to the OS, system drivers & programs presently.
3. Be aware of your own online habits and how you would stand without those "reminders" and/or configurations.
4. Have your Installation or Recovery CDs and all keycodes & passwords available to use and know how it's done in your particular case.

Thanks for the post topic, bilsullivan. Good replies, too.

After being frustrated with Aurora, I received the following reply from the compnay. One of the suggested websites worked very quickly and easily, whiile the other did not. The problem was solved .

"Thank you for contacting Mypctuneup support! We apologize for the delayed response to your email, and thank you for your patience.

Mypctuneup.com performs technical support for a number of companies and we are sorry to hear that advertising software is causing you problems. We will gladly assist you in removing our partners' advertising software from your computer as expeditiously as possible.
From our website you can scan your PC and determine whether or not the software is installed on your machine, and if so, you can then choose to uninstall. To run the uninstall tool click on the link below:
http://www.mypctuneup.com/evaluate.php
Or go to www.mypctuneup.com and click on free uninstall tool and follow the steps.

We hope you find this helpful. Thanks again for your continued patience."

We dont trust that tool. It still leaves way too much behind

The fix I posted just before I came back to edit did not work, lol Thanks to everyone else for their posts