Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Aurora (Nail.exe, related Registry Keys)

  • Please log in to reply
1 reply to this topic

#1 busam1


  • Members
  • 8 posts
  • Location:SoCal
  • Local time:11:36 PM

Posted 07 June 2005 - 06:29 AM

How do I stop Aurora reinfection? Aurora (Nail.exe and related Registry Keys) repeatedly infects PC many times daily, even after removal by anti-spyware or direct deletion.

Attempted fixes:

1) Used XoftSpy 4.13 anti-spyware to locate and remove Aurora (Nail.exe and related Registry Keys), but all return.

2) Deleted c:\Windows\Nail.exe, and removed Aurora Registry Keys, but all return.

3) Replaced Nail.exe with dummy text NAIL.exe, but Aurora related Registry Keys return.

PC: Compaq Presario S4300CL, Windows XP Home (Ver 5.1, SrvPk 1)
Internet Connection: Cox broadband cable
Protection: McAfee Personal Firewall Plus (Build 6.6.6144, default settings); McAfee VirusScan (Build 9.1.08, Engine 4.4.00, DAT 4.0.4506)
Frequent Websites: http://www.investorshub.com/boards/default.asp ; http://finance.yahoo.com/ ; http://www.bungie.net/

Any ideas to prevent Aurora reinfection? :thumbsup:

Edited by busam1, 07 June 2005 - 08:21 AM.

BC AdBot (Login to Remove)



#2 busam1

  • Topic Starter

  • Members
  • 8 posts
  • Location:SoCal
  • Local time:11:36 PM

Posted 11 June 2005 - 02:15 AM

AURORA (Nail.exe and related registry keys) repeated infection appears to be stopped by Spyware Doctor anti-spyware & its OnGuard real-tile protection.

6/7/05 - Purchased and Downloaded SpyWare Doctor and updated its reference files. Ran Full System Scan which includes deep registry and file system scanning. Located and quarantined over 1694 infections consisting of multiple instances of BearShare, Common Components for VX2, Media Access, NeededWare, WhenU.SaveNow, YourSiteBar, Advertising, Tracking Cookies(s), Common Components for WindUpdates, SurfSideKick, CWS, Bargain Buddy, Instant Access, CWS.Home Search Assistant, and Transponder.Bolger.

After scan, activated SpyWare Doctor's OnGuard feature which provides real-time protection by blocking malicious activity.

Ran 10 subsequent Quick Scans over several days. No infections found. No AURORA has been detected by any subsequent full or quick scans by either SpyWare Doctor or XoftSpy (another downloaded anti-spyware). :thumbsup:

6/10/05 - Ran another Full System Scan of SpyWare Doctor. Located and quarantined only 1 infection - one instance of Bargain Buddy. No AURORA. :flowers:

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users