When surfing the net, I constantly receive random pop-up advertisements, which say "Aurora" at the top on the bar. This is clearly some type of spyware/virus, and I was wondering whether anyone has any clue how to get rid of this. I've tried Ad-aware, Spybot, HijackThis, CWShredder, Norton Antivirus 2004, all with no success...

Sorry, I didn't realize that there was a "security" section on this site. I will move the topic there.

I am also having this same problem! I have tried running, spy sweeper, Microsoft anti spyware, Ad-Aware, and AVG antivirus, nothing works. I don't know where they come from or why they aren't detected. But they are driving my crazy!

Go to the following link and download the "uninstall" program to get rid of the Aurora adware. It is not spyware and was received by you when you downloaded free software from somewhere. I had the same problem -- none of my anti-virus programs worked against it. It had to be uninstalled. When I ran the uninstall -- the aurora's disappeared!! :)

Go to: mypctuneup.com/aurora

I went to mypctuneup.com/aurora and did what I was told. But I couldn'y go through with it. I got this terrible sense of foreboding that in my despair of failing to fight the aurora menace, I was being suckered into getting something just as bad or even worse into my computer. Why would I trust "mypctuneup.com"? Who can tell me reliably that this isnt a front for another scumbag group of people haters.

huh

It's OK. It seems a bit weird, I can only hope that they are only collecting stats by needing to have your PC connected to the web when you run the tool, and it doesn't give much feedback as it's running either. But the aurora popups have stopped and the oddly named .exe that was running and would restart under a different name when killed has gone as well.

So, it seems OK.

You are braver than I am. Let's suppose that the folks at mypctuneup.com are part of the aurora dissemination plot, or worse, have some insidious, evil malware of their own that they want us suckers to have in our systems. Let's suppose that. So I start to wonder, who put the post on here to use it. And if that was an attempt to sucker us in, why would it not be expected that another post appears that says, "go ahead suckers, I used it, it's ok". It seems that this aurora/nail menace has only emerged this month (April 2005) because none of the money making heavyweight sleeping giants, Norton, McAfee, MS, and so on seem to know anything about it.

huh

it's much easier than all that, all you need to do is click on the question mark in the top right corner of the pop up n it will explain how to remove the pop up

I also have this problem, though I do not recall downloading any "free" software recently. I did try to uninstall it and followed all of directions it gave. Nothing changed. That was a few days ago so I'm about to try it again just for the h*ll of it.

I tried it again. Still nothing.... If any of you have better luck I'd like to know what I did wrong.

I'm having same problem here. Aurora popups just pop up even if i'm playing a game on my computer. This is a strange one.

I used the tool and it removed the Aurora crapware with no problem. This Aurora was one of the hardest spyware/adware I've yet to come across to remove.

I used the tool and it seems to have worked thus far. I ran Spybot s&d immediately after using it (after the reboot), and I had 'No Immediate Threats'. I will post if I get any more.
By The Way...If you were surfing on any of the following websites, you likely got the malware/ spyware from at least one of them:
iconcave.com
animeim.com
arcadetown.com
coolbuddy.com
funnyjunk.com
originalicons.com
freevibe.com
gamespot.com
picgames.com

As you have probably figured, these sites were the only unrecognized sights in my browser history when I got the Aurora problem.

No1Bobo@Yahoo.com

Has anyone tried this guy's fix? I tried it and so far, so good. Just seems too easy!
http://www.computertalkamerica.com/modules.php?name=News&new_topic=12

I went to where bob77511 recomended to go and it worked. It took like 3 easy steps to type! I cleaned my computer 3 times and ran norton and ad ware and nothing worked. I looked at other soluations but they seemed too hard and too risky but this was simple and you didn't have to go to any site to download anything. so here it is 4 in the morning but no more aurora pop ups. thank you!

I tried Bob77511's suggest as well, and it worked wonderfully .. so far no more of those terribly annoying aurora pop up's have bothered me. I also like that I was able to remove it with out having to use aurora's own *special* removal program. Thanks for the great info Bob77511!

Well, unfortunately I am back to report that the suggestion from Bob77511 seems to be only a temporary fix. (sorry Bob, it was worth a try, and I still truly appreciate your help). Though it worked well for awhile, I have gotten some aurora pops ups here and there since then. However, they don't seem to be happening near as much. I'd much rather be totally rid of them though, so if anyone comes across anything that is a permanent fix, please share. I may end up breaking down and using the actual program for removal that aurora provided .. I'm just not ready to try that yet though, we'll see. Keep us posted. Thanks

I agree with D Cook. Bit the bullet and ran mypctuneup.com/aurora uninstall and it appears to have solved the problem. The interesting thing about this little piece of possessed binary is that there is another executable in the works that has not yet been identified. Another file has to keep reloading the nail.exe file back into the windows directory. I'd be interested to know its name. That's what makes it so hard to eradicate. Nail.exe is the second in the chain and the 6 random letter named file that actually runs and is visible in the task manager is the third.

Try a free download of Webroot's Spysweeper and run it. I think you can find them at webroot.com. Seems to have done the trick, at least for now. My computer had hundreds of these things in it, all removed by Spysweeper. Thank you Spysweeper! I will buy your stock.

I was REALLY hesitant to go to the link suggested above (mypctuneup.com/aurora). Brought to you by the same people who bring you the damn pop-up in the first place. The link came up in its own pop-up - this benevolent company wants to ensure you get a "better internet experience" by downloading their uninstall program!! It that the greatest?

I haven't tried the uninstaller yet. But plan to. I've been using ad aware along with ad watch that comes with it. So far it keeps the pop-up from appearing. I would recommend using this combination, even if you used the uninstaller, to keep from getting it again. Make sure to check the
necessary settings in ad watch and have it load on start up.

James Meeks

I gave in and went to mypctuneup.com/aurora (clicking on question mark)...it's been 2 weeks now and no pops and no other issues. Spyware Doctor can't find anything.

Check out...
http://mypctuneup.com/privacy.php
and
http://mypctuneup.com/

"The MyPCTuneUp uninstaller program will never collect any personally identifiable information, it will not install any additional programs, and it will delete itself once it finishes the uninstall process." As far as I can tell, this is true.

Also, along with removing the nail.exe, it found and removed this file that had the aurora icon:
"wtsvizptwu.exe"
Description: Buddy
Version: 1.0.2.4

Best of luck to all.

I went to the site mypctuneup.com\aurora and downloaded the uninstall program (as the pop-ups suggested). I was really hesitant to do this so I did it first on a friend's work computer (ha ha!) and it seemed to do no damage. So, I downloaded it onto my pc and so far so good (it's been only five minutes though).

Webroot Spysweeper only seemed to take care of the problem temporarily.

Anyway, good luck!

Here is the most reliable info I have seen to remove this adware, it comes from the Hijackthis blog. Just follow the link to review the article:

http://forum.hijackthis.de/showthread.php?t=3172

Good luck out there

Tim

I did ctrl, alt,delete while the pop up was still up to access Windows task manager, found "aurora" and hilighted it. Then I selected the processes tab and it showed me this "mefrtjkbw.exe". After searching my system I found it in my windows folder as it's logo icon "mefrtjkbw.exe" and a piece of it in windows prefetch folder under the same .exe name. I have just right clicked and deleted these and haven't had a problem.

Nevermind my last post. It came back.

well, i just got my computer brand new two days ago and i already have aurora..and the only thing i have downloaded so far is... Kazaa, Napster, and 2FindMP3. And like, 1 .mp3 file from Kazaa. That's all that i think i downloaded since i got it. I guessing it's from one of those unless you get it just from visiting websites. I'm clueless but i'm about to try that Uninstall Program. Also ran Ad-Aware, SpyBot:S&D, and Norton, none of those worked.

argh I'm ready to effing SCREAM!!!! I've been getting these damn aurora pop ups for the past week and when I go to www.mypctuneup.com/aurora it says HTTP 403 (Forbidden) You are not authorized to view this page. So I guess I'm stuck with these stupid things? Can someone please help me?

Fully-updated MS Antispyware detects aurora as transponder.abetterinternet.aurora and runs from the files c:\winnt\nail.exe and c:\winnt\svcproc.exe.

Download nailfix for XP at
http://users/pandora.be/bluepatchy/nailfix.zip and nailfix for Win2K at
http://users/pandora.be/bluepatchy/nailfix2k.zip
Reboot into safemode prior to running the fix. After running the fix, reboot into normal mode and run a full scan with MS Antispyware (fully updated) and see if aurora is detected.

The foregoing procedures worked for me. After several reboots and internet connections, I still get clean HiJackthis logs, clean prefetch, and no aurora popups.
Fraggedout

Aurora is run by a co. in New York.
Their website is www.direct-revenue.com
If you go to this site it will give you a link to the mypctuneup uninstaller program.,and also a forum to tell them what you think of their `product`.
However the uninstall program is easy to download and run and seems to be working ok.

I used the mypctuneup.com uninstaller program and, for the moment, the popups have not come back yet. I do have another problem that I have not yet heard people talk about. I have system mechanic 5 pro. When I check for updates my computer (with Aurora previously on it) can't find the kaspersky antivirus website. This same problem happens when I try to go to the symantec.com website. I noticed this right after I got the aurora problem. Now, on my other computer which did not have aurora, it goes directly to the designated websites with no problems. It's almost as if aurora is keeping me from viewing these anti virus websites so that it cannot be removed. Is anybody having a similar problem such as this?

Adware alert gets rid of that annoying pop up. i tried everything before and nothing else worked. its a really good program

well i had the virus on my comp i used zonealrm to blok it from poping up it worked and now i know longer have the problem but now i cant acess secure sites and java scrip dont work on my comp