Nail.exe

[Jose]

Hello
I have been having serious problems trying to clean
up my pc infected by Nail.exe. My AntiViruas clena it but
at the same time it come back. Please help me...

 

[Ron Chamberlin]

Hi Jose,
Boot into Safe Mode (F8) at startup;
Empty your temporary files AND your Temporary Internet Files* C:\Documents
and Settings\Username\Local Settings\Temporary Internet Files folder ;
Run the scan while in safe mode;
If you are running SP2, open IE--->Tools--->Manage Add-ons, and uncheck any
BHO's that you don't recognize.

Ron Chamberlin
MS-MVP



*The .tif are Temporary Internet Files, and are stored in a different barn
than 'normal' temp files.
Here's how I kludge thru to them: Open Windows Explorer--->C:\Documents and
Settings. Then it's to the Tool Bar--->Folder Options--->View--->Hidden
Files and Folders and check the box "Show hidden files and folders" > Now
expand C:\Documents and Settings and under each user you will now see a
folder "Local Settings". Open that puppy and choose Temporary Internet
Files. I am not concerned about the cookies therein, but everything else
can go for now.

 

[Bill Sanderson]

Look for threads--I believe there's a good one in
..announcements--referencing "aurora" for this one.

This one probably isn't cleanable by your antivirus even in safe mode. I
don't know whether the newest defs for Microsoft Antispyware attempt to
clean it or not--trying with both antivirus and antispyware in safe mode, as
Ron mentions--is one thing to try.

 

[Ron Kinner]

Turns out there are two versions of nail. One of them can
be cleaned by disabling the service, booting to Safe Mode,
running HijackThis and leaving it up then killing explorer
and iexplore then back to Highjackthis and check / Fix
Checked. I've killed about 10 that way.

The other one I think can be killed with mwav.exe which is
a 10 meg program so you need a fast link to get it or a
friend with a fast link and a cd burner.

http://www.spywareinfo.dk/download/mwav.exe

Program can take several hours to run so be very patient.

Ron

 

[Bill Sanderson]

Life is getting tougher. Ever see what you find if you look for mwav.exe
via Google?

 

[Bill Sanderson]

That should take a long time--I believe it is kaspersky's command-line
engine under somebody elses gui. I'm going to ask someone I know who uses
Kaspersky about this.

It's ugly--I don't line referring anybody to this kind of app (free scan,
pay to clean.) OTOH, this is probably one of the best scanners available,
and the updater works--so you can be sure it is current.