Do not, UNDER ANY CIRCUMSTANCES, use mypctuneup.com. It is owned by Direct Revenue LCC, the same company that produces Aurora. In an article by a LEGITIMATE anti-spyware company, it is stated, "None of the installed programs [of Direct Revenue, including Aurora and mypctuneup] have information that identifies them as a product of Direct Revenue, nor do the programs have the brand name of Ceres or Aurora clearly identified in the executable files. One of its running programs uses a randomly generated file name [your gmbgklixrp, tash] so it is impossible to tell what the file does. The others are named in vague or deceptive ways such as "System Startup Service" or "Nail.exe". (http://www.pcpitstop.com/news/drnotice.asp) Mypctuneup will remove nail.exe, but will make many more problems for your computer. In the licensing agreement before installing mypctuneup, you allow the installation of a web bug. Also, you consent for your "non-personal information", including IP address, ISP, domain, to be recorded. The legitimate, well reviewed (by cnet and pcmagazine) program Webroot Spy Sweeper can be used to quarantine and nullify the effects of Aurora (use the 30 day trial). Finally, mail a complaint to Direct Revenue LCC, located at 107 Grand Street, 3rd Floor in Manhattan or call them at 646-613-0376. Feel free to email me with any questions.

Some more info about the uninstaller. http://webhelper4u.com/directrevenue/directrevenuenews1.html New Ad Client Affords Greater Brand Visibility, More Efficient Distribution http://www.direct-revenue.com/news6.php

that one is a mother to get off...

Thats some good info, Abnormal. Its been one week and Aurora hasn't come back because of webroot.

good to know. I had to remove it without benefit of the link and figure out how it was creating randomly named generated files as processes every time it got deleted. as i said b4, a mother!

please help. I have spy sweeper and still see the same removal each time. HELP. Tell me what I'm doing wrong. I even go thru explorer to delete file. Please help. I don't want to dump my disk if possible, but I'm at an end here.

first off, the first post saying that none of the files identify themselves as direct revenue is incorrect. You just have know where to look. If you open the properties of the file and click the version tab and then highlight "company" in the list it will show up as Direct Revenue. This would only be needed if you cannot find the filename of one of the files that ABI uses by other means. You should be able to find this file in your AV quarantine. It will be something like this: abunchofletters.exe (xxxxxxx.exe) If you can find this file, e-mail me and I will send you the fix. I put it in a text file because so many people are needing it and I got tired of typing it each time.