ADWARE/SPYWARE (Aurora AKA ABetterInternet)

[Mary]

HELP! SOS!
I have been trying to get rid of "A Better Internet"
Adware/Spyware on my computer for several days. I even
called the company located in NYC 646-613-0376--no one
answers the phone then you are directed to leave a
message or told to go to their website to download
uninstall software.(which I would never do!) I left a
message and they have not returned my call.

Once I remove with MS AntiSpyware
C:\WINDOWS\system32\DrPMon.dll
after rebooting and running a scan again I find
c:\windows\system32\drpmon.dll
Again I remove with MS Antispyware
after rebooting and running a scan again I find
C:\WINDOWS\system32\DrPMon.dll

(PLEASE NOTE: case sensitivities)

It seems to self generating and then propagates
additional adware pops up from Icannews and Navidad Worm
(Worm).

I also noticed the addition of empty files--which I
believe is where the self propagating adware"grow" from.

Is it possible to delete a .dll in C:\WINDOWS\system32?
Is it possible to delete all my software and then
reinstall my software with the hopes of deleting the
adware/spyware?

Thanks--Any help is greatly appreciated.

 

[Andre Da Costa]

From Andy:
Download Nailfix to your desktop

Primary:
http://www.noidea.us/easyfile/file.php?
download=20050515010747824

mirror:
http://www.dknoppix.com/cgi-bin/download.cgi?Nailfix


Reboot into safe mode (Reboot and keep tapping F8 then
choose safe mode from the list)

in Safe Mode, double-click on nailfix.bat. Your desktop
and icons will disappear and reappear, and a window
should open and close very quickly.

This will stop and delete nail.exe and svcproc.exe


Then run MS Antispy on a full system scan to remove any
other files.Ewido Security Suite and Adaware SE both
target Aurora so maybe worth trying them if you have more
problems with it.The problem is the random named file in
the system folder which will act as a re-installer each
time you reboot.Plus it changes its name whenever you
reboot.Ewido will remove those entries.Adaware will
remove Bolger and Drpmon.dll so again it could help.

AndyManchesta

Evido:
http://www.ewido.net/en/

Lavasofts Adaware:
http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022-10399602.html?tag=list

--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

 

[Guest]

I too have the same problem; Tried Adaware, Norton
Anitvirus, Microsoft Antispyware and did finally go to
the site to install the "uninstall". It tells you to
dismantle the virus protection and firewall. The program
ran all night and never completes the scan, so don't
waste your time. Contact support via phone or email gets
no response other than automated reception.

The Microsoft product finds and allegedly deletes it, but
after you restart the computer, its still there.

Mary, if someone sends you email telling how to remove,
please forward to me!

I'll keep checking this site and if anyone has a
suggestion, I too would be grateful.

 

[Andre Da Costa]

From Andy:
Download Nailfix to your desktop

Primary:
http://www.noidea.us/easyfile/file.php?
download=20050515010747824

mirror:
http://www.dknoppix.com/cgi-bin/download.cgi?Nailfix


Reboot into safe mode (Reboot and keep tapping F8 then
choose safe mode from the list)

in Safe Mode, double-click on nailfix.bat. Your desktop
and icons will disappear and reappear, and a window
should open and close very quickly.

This will stop and delete nail.exe and svcproc.exe


Then run MS Antispy on a full system scan to remove any
other files.Ewido Security Suite and Adaware SE both
target Aurora so maybe worth trying them if you have more
problems with it.The problem is the random named file in
the system folder which will act as a re-installer each
time you reboot.Plus it changes its name whenever you
reboot.Ewido will remove those entries.Adaware will
remove Bolger and Drpmon.dll so again it could help.

AndyManchesta

Evido:
http://www.ewido.net/en/

Lavasofts Adaware:
http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022-10399602.html?tag=list

--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

 

[Mary]

I removed all Aurora/ABI/ABetterInternet with the
suggestion from "Alien" July 6 2005 3:52 AM (Online
Community)

www.ewido.net (FREE 15 day trial)-- It worked like a
charm. It took 90 minutes and located 52 suspect files.

After running ewido, I ran MS Anti-spyware and it found
only one remaining adware/spyware ICanNews (4 signatures)

I reported this to Ewido and MS hopefully one of them
will come up with a fix for ICanNews.

Good Luck