Adware Aurora

[Guest]

Beta has done well on all of the ad ware on my computers but, I have run into
a Aurora_adware and a Drpmon that can not be removed. It does a good job
recognizing these on my system but it can not remove them. This malware has
the ability to replicate itself as fast as they are removed. I also use
nortan anti-virus and get the same result. The files just replicate itself
and keep on running. And any attemp to delete the files fails.

 

[Guest]

Please follow the thread "Aurora" started by (e-mail address removed)
9/13/2005 on microsoft.private.security.spyware.GENERAL

 

[Guest]

Aurora has been around since about April this year so I`m surprised MSAS is
not removing it. Are you performing a deep scan in Safe Mode? If not you
should do so and repeat until your system scan comes thru clean. I would
suggest scanning with Spybot S & D and Adaware also - don`t forget to make
sure you have the latest defs before you do.

Stu

 

[Guest]

Hi Dave,

Here is the post:

From: "AndyManchesta" 9/13/2005 6:17:47 PM

Hi There

Here's a fix for Aurora


Download Adaware SE
--------------------
http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10045910.html

Get all updates and close Adaware


Download Adaware's VX2 cleaner Plugin
--------------------------------------

http://updates.ls-servers.com/vx2cleaner.zip

Save to desktop then extract and run the installer which will install the
cleaner into the Adaware Plugins folder


Download Ccleaner
-------------------

http://www.ccleaner.com/ccdownload.asp


Run Adaware SE and choose Add-Ons from the main menu.Select VX2 Cleaner from
the list.

Click the "Run Tool" button in the lower right corner of the window.Click
"OK" when asked if you want to execute this tool.It will say VX2 variant
found then press clean.Next it will say to reboot and run a smart scan with
Adaware.


Reboot and run a full scan with Adaware SE and remove anything found

Run Ccleaner and press "Run Ccleaner"


This will now be fixed but there will still be a file left in the windows
folder that isnt active, Its a random name and can be identified as a gray
globe icon with a thin orange strip going around it and when you move your
mouse over this it will show Aurora and DirectRevenue in the details, Delete
this or if you have problems use Ewido Security Suite and this will delete
that file


Download Ewido if needed

------------------------------

http://www.ewido.net/en/download/

When installing, under "Additional Options"
uncheck "Install background guard" and "Install scan via context menu".

From the main ewido screen, click on update in the left menu, then click the
Start update button.

After the update finishes (the status bar at the bottom will display "Update
successful")

From the main menu click Scanner the Complete system scan and remove
anything found.


Let us know if you have any problems

Regards Andy

Good luck Dave

Engel

 

[Dave M]

Two previous threads to help you:

From: "Randy Knobloch"
Subject: Lavasoft Ad-aware VX2 Cleaner V2.0 Plug-in
Date: Mon, 10 Oct 2005 02:32:01 -0400
Newsgroups: microsoft.private.security.spyware.announcements

From: "CarolineS"
Subject: Aurora...new file discovery
Date: Mon, 26 Sep 2005 14:19:37 -0400
Newsgroups: microsoft.private.security.spyware.general