Wednesday, July 27, 2005

Nail.exe / Aurora removal instructions

I got this garbage spyware from somewhere - be advised it is a high-risk trojan - let's call it IT, Nail.exe is just a by-product of IT (it is 04 in your registry and is in .exe format, also in system32 folder - and that IT keeps changing names) and unless you get rid of the source (IT) Nail.exe will keep respawning - in turn spawning more garbage (i.e. BetterInternet something) - took me 7 hours to find out how to get rid of it - so here is how to do it without any fancy stuff:

1) run any anti-spyware you have: i.e. Search and Destroy, Lavasoft Microsoft Anti-Spyware - get rid of all by-products
1.1) use highjackthis (http://www.download.com/HijackThis/3000-8022_4-10227353.html) (A MUST PROGRAM FOR ANY AMATEUR VIRUS FIGHTER) - it's free, run it - you will see one extra F2 value - with Nail.exe at the end, and unusual 04 value that has extension exe. r <-that r is virus giveaway 2) (http://securityresponse.symantec.com/avcenter/FixBinet.exe) <- this is the fix for Nail.exe, download and run it - Nail will be taken out temprary; now comes important part - getting rid of IT 3.1) turn off your system recovery - right click My Computer/ properties / system recovery -uncheck 3.2) now run free online spyware and virus check at - http://housecall.trendmicro.com/

* that check is very concise - it will dispose of any remaining by-products of IT - and will narrow down our IT - which has a name - TROJ. AGENT.UX - and guess what it can't clean it - now write down the name of that infected file (you'll get it in details)

3.3) restart your computer in SAFE MODE, by pressing F8 before Windows loads, do not eanble system recover - now go into Start-Run and in run window type "regedit", in registry go to HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/Current/Run
3.4) in run sub-directory - find that value you wrote down in 3.2 - and delete it, as well - search registry for following "aurora", "nail.exe" <- delete all values associated with it



4) restart - u might get an error message that Nail.exe is missing - HAHAAHAHA, in your face virus - now run everything again - Anti-Spyware, then TrendMicro again - and this time you should be able to delete this now-disabled bug, now reset all internet settings ... cross your fingers and RESTART

5 and final) run Highajckthis, anti-spyware, TrendMicro last time - and you are done


DONE AND DONE, take a deep breath - you made it

6 Comments:

Anonymous Anonymous said...

This comment has been removed by a blog administrator.

2:17 PM, July 27, 2005  
Blogger Tx Texas House Cleaning said...

This comment has been removed by a blog administrator.

8:27 AM, February 07, 2006  
Blogger oakleyses said...

louis vuitton, christian louboutin outlet, uggs outlet, michael kors outlet online, michael kors outlet, ray ban sunglasses, jordan shoes, polo outlet, louis vuitton outlet, oakley sunglasses, nike outlet, michael kors outlet, prada handbags, ugg boots, prada outlet, uggs outlet, polo ralph lauren outlet online, nike free, ray ban sunglasses, chanel handbags, ugg boots, kate spade outlet, longchamp outlet, louis vuitton outlet, ray ban sunglasses, tiffany and co, replica watches, tiffany jewelry, longchamp outlet, uggs on sale, burberry handbags, replica watches, cheap oakley sunglasses, nike air max, christian louboutin shoes, gucci handbags, louis vuitton outlet, louis vuitton, burberry outlet, michael kors outlet online, michael kors outlet online, michael kors outlet online, nike air max, tory burch outlet, oakley sunglasses

1:23 AM, February 25, 2016  
Blogger oakleyses said...

oakley pas cher, true religion outlet, nike free uk, nike air force, guess pas cher, sac longchamp pas cher, converse pas cher, polo ralph lauren, hollister uk, north face, timberland pas cher, nike air max uk, michael kors pas cher, abercrombie and fitch uk, burberry pas cher, coach outlet, north face uk, jordan pas cher, coach outlet store online, michael kors, ray ban uk, vans pas cher, michael kors, mulberry uk, new balance, hollister pas cher, nike roshe, nike blazer pas cher, michael kors outlet, nike tn, true religion outlet, coach purses, air max, nike roshe run uk, lululemon canada, true religion outlet, polo lacoste, nike free run, ray ban pas cher, hogan outlet, sac vanessa bruno, nike air max uk, longchamp pas cher, true religion jeans, sac hermes, kate spade, nike air max, ralph lauren uk, louboutin pas cher, replica handbags

1:25 AM, February 25, 2016  
Blogger oakleyses said...

timberland boots, valentino shoes, jimmy choo outlet, north face outlet, instyler, nike trainers uk, ipad cases, oakley, nike air max, hermes belt, lululemon, hollister clothing, nike roshe run, nike huaraches, mac cosmetics, soccer jerseys, longchamp uk, north face outlet, herve leger, ghd hair, abercrombie and fitch, iphone 6s cases, beats by dre, p90x workout, chi flat iron, s6 case, iphone 6 plus cases, baseball bats, asics running shoes, mcm handbags, iphone 5s cases, celine handbags, vans outlet, iphone 6 cases, bottega veneta, iphone 6s plus cases, iphone cases, giuseppe zanotti outlet, louboutin, soccer shoes, ralph lauren, reebok outlet, insanity workout, wedding dresses, hollister, mont blanc pens, new balance shoes, ferragamo shoes, babyliss, nfl jerseys

1:28 AM, February 25, 2016  
Blogger oakleyses said...

karen millen uk, ugg,uggs,uggs canada, ugg,ugg australia,ugg italia, pandora uk, canada goose, swarovski, louis vuitton, canada goose, nike air max, moncler uk, juicy couture outlet, moncler outlet, canada goose outlet, moncler outlet, canada goose, lancel, thomas sabo, pandora jewelry, gucci, louis vuitton, barbour, converse, moncler, moncler, replica watches, pandora jewelry, pandora charms, vans, montre pas cher, ugg uk, doke gabbana, supra shoes, hollister, canada goose outlet, louis vuitton, ray ban, ugg, links of london, converse outlet, coach outlet, canada goose uk, moncler, moncler, juicy couture outlet, canada goose outlet, louis vuitton, louis vuitton, toms shoes, canada goose jackets, barbour uk, marc jacobs, swarovski crystal,

1:30 AM, February 25, 2016  

Post a Comment

<< Home