Help - Aurora, Nails.exe, Transponder.Bolger

[Steve]

MS Spyware Beta Does not remove Aurora pop up , Nails.exe,
Transponder.Bolger, any suggestions

 

[Andre Da Costa]

If you are under attack and MSAS does not seem to help:

*Submit suspected spyware report in the tools menu of MSAS*

PREP YOUR MACHINE FIRST!
- IF you are using Spybot S/D, UN-Immunize your computer
- IF you are using Adaware, turn off AD-Watch
- Disable all other active anti-spy applications
- Dump all temporary file locations and Internet files

1. Download:
lspfix.exe www.cexx.org/lspfix.htm
winsockxpfix.exe www.snapfiles.com/get/winsockxpfix.html
ccleaner.exe www.ccleaner.com
killbox.exe www.bleepingcomputer.com/files/killbox.php

2. Clean out all temp file locations with ccleaner.exe

3. Install and use killbox to delete stubborn files

4. Reboot into safe mode - http://tinyurl.com/pfca
5. Run MSAS at least twice in full/deep mode
6. Run a robust, updated antivirus software scan
7. Reboot into normal mode,see if problem has been corrected

8. If you think something is there but can't see it, download:
- Blacklight by F-Secure
www.europe.f-secure.com/exclude/blacklight/blbeta.exe
- RootKitRevealer by SysInternals
www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml

9. If your problem is Virus or Security patch related:
In the United States or Canada, call 1-866-PCSAFETY
MS will provide free support for those issues.

Battle Notes:
- If you have trojans (files that won't go away),
you may have to disable System Restore on XP:
http://tinyurl.com/movy

- If your Internet connectivity quits:
http://support.microsoft.com/kb/892350
http://support.microsoft.com/kb/811259
LSPFix - www.cexx.org/lspfix.htm
Winsockxpfix - www.snapfiles.com/get/winsockxpfix.html

- Install SpywareBlaster to block malware apps from
installing on your machine. Does not actively run
on your machine, you run it, it makes changes that
protect you.
http://www.javacoolsoftware.com/

- This program will not detect or remove viruses
http://www.microsoft.com/athome/security/viruses/default.mspx

*** For assistance in battling infestations***
- Get HijackThis.exe from:
http://tomcoyote.org/hjt/hjt199//HijackThis.exe
- Save it to C:\hjt (new folder)
- Open it and select "Scan and Save Log"
- Send it to Ron Kinner as an attachment
- Ron's email address is (e-mail address removed)
- Put Hijack in the subject so he knows it's not spam

Application Notes:
Registering a VB6 dll seems to fix missing agents:
1) Open up a command prompt (start -> run -> cmd)
2) Type in the following "regsvr32 msvbvm60.dll" (without the quotes).
3) Close and re-open Windows AntiSpyware
4) If that fails, install VB6 runtime files:
http://www.softwarepatch.com/windows/vbrun6download.htm

- To report false positives:
www.microsoft.com/athome/security/spyware/software/isv/fpform.aspx
- To submit disputes or requests:
www.microsoft.com/athome/security/spyware/software/isv/cdform.aspx
- To learn more about how MS analyzes suspected spyware:
www.microsoft.com/athome/security/spyware/software/isv/analysis.mspx
- To Run MSAS in passive mode:
http://support.microsoft.com/kb/892375

Alternative Anti-Spyware Applications:
- Spybot Search and Destroy
http://www.majorgeeks.com/download2471.html
- LavaSoft AdAware
http://www.majorgeeks.com/download506.html
- AdAware VX2 Cleaner Plugin
http://www.majorgeeks.com/download4283.html
- BHODemon
http://www.majorgeeks.com/download3550.html
- CWShredder (CoolWWWSearch)
http://www.majorgeeks.com/download3019.html
- PestPatrol
http://www.majorgeeks.com/download1187.html
- Webroot Spysweeper
http://www.majorgeeks.com/download3263.html
- Ewido Security Suite
http://www.ewido.net/en/
- CounterSpy (Same Giant Company Engine as MSAS)
- http://www.sunbelt-software.com

Recommended Software to help protect you:
- Windows XP Service Pack 2
http://www.microsoft.com/windowsxp/sp2/default.mspx
- SpywareBlaster
http://www.javacoolsoftware.com
- Outpost Firewall Pro
http://www.agnitum.com/products/outpost

 

[Engel]

From: "Ron Kinner" <[email protected]>
Following are the latest malware and therefore the hardest
to remove:

Called nail.exe aurora or bolger.
http://webhelper4u.com/tnewswritigs/bolger_aurora.html

Ewido seems to detect and remove one version which can
also be removed by disabling its service, booting into
Safe Mode and using HijackThis to get rid of the nail and
exe (with Explorer and Iexplore turned off) then Killbox
to remove nail on reboot. but there is another version
with a TODO file that requires a repair console delete or
you can go to the maker www.mypctuneup.com/aurora and run
their uninstall which gets rid of aurora but may install
something else. They make you fill out a form and then
will send you a code to use with the uninstaller. Use a
throwaway email address if you do and lie like crazy on
the form.

http://www.webhelper4u.com/tnewswritigs/mypctuneupmain.html

Another popular one right now is wp.exe which is the
smitfraud.c and which tears up the registry entries for
your desktop so you can't remove the warnign that
appears. Changes the registry to to add System under
Policies and adds some keys to limit the Display
Properties by removing Web and Background tabs.

This is it here:

http://securityresponse.symantec.com/avcenter/venc/data/tro
jan.desktophijack.html

(Same link but in smaller form since i guess that one will
wrap)

http://tinyurl.com/87n46

Then we have the bhoass.dll "Trojan.Win32.Agent.cx"

C:\WINNT\system32\bss.dll
C:\WINNT\bhoass.dll
C:\WINNT\system32\MSIMN32.EXE
C:\WINNT\system32\TASKMGRU.EXE
C:\WINNT\explorer32dbg.exe
C:\WINNT\iexplore_dbg.exe
C:\WINNT\ghj

this is just six of the files. There are about 10 in
all. The only way I can get rid of them is to use Killbox
to delete all of them on boot. And afterwards Explorer
(the desktop) won't run. Sample hjt log:

http://www.techsupportforum.com/computer/topic/49162-1.html

Also have a random named file that attaches itself to
winlogon notify and won't let go. Often seen in the
company of another random name file that pretends to be
Kavsvc or Navsvc. The Kavsvc file will sometimes go away
with mwav.exe from kaspersky. Nothing seems to work on
the winlogon notify critter. Believe it's a variation on
L2M.

O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\rlinzp.exe
O20 - Winlogon Notify: OemStartMenuData -
C:\WINDOWS\system32\p2r4lc9q1f.dll

None are removed completely by AntiSpy unless there has
been a new update that I don't know of..

One final tip. A lot of the new stuff seems to use the
Task Scheduler as a backup. Start, (Settings,) Control
Panel, Scheduled Tasks and remove any that you don't
recognize especially any that have a path that includes
the Application or Temp Folders.

Ron


Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then send
it to Ron Kinner as an attachment. He can probably
identify the problem and tell you how to get rid of it for
good.

Ron email address. (e-mail address removed)
He will tell you what to do next. Put Hijack in the
subject so he will know it's not spam.

For information
HijackThis tutorial:
http://www.bleepingcomputer.com/forums/index.php?
showtutorial=42

 

[Bill Sanderson]

Here's another answer from Ron Kinner:

---
Just successfully removed two nail.exe infections today
with the procedure at:

http://forum.hijackthis.de/showthread.php?t=3172

The ABIRemover.exe is a miracle worker!

Ron