pop up opening windows

[herbert feller]

I have removed C:\WINDOWS\Nail.exe from my computer.
When I open windows I'm getting a pop up saying that C:WINDOWS\Nail.exe
cannot be found. Why is this pop up doing that every time I open windows?
How do I correct the problem?

Thank you..........Herb

 

[Nepatsfan]

I have removed C:\WINDOWS\Nail.exe from my computer.
When I open windows I'm getting a pop up saying that
C:WINDOWS\Nail.exe cannot be found. Why is this pop up doing
that every time I open windows? How do I correct the
problem?
Thank you..........Herb

A registry entry was probably left behind. Run msconfig and
look for an entry pointing to Nail.exe. Note the location. Run
regedit. Navigate to the location listed in msconfig and delete
the entry.

Good luck

Nepatsfan

 

[Leythos]

Run hijackthis and post your log file to just
click on the link, no registration required.

 

[Leythos]

Run hijackthis and post your log file to just
click on the link, no registration required.

Nice going PCBUTTS, you still can't post with your real identity, and
the headers always give you away....

Only download software you can validate as uncompromised - in the case
of non-vendor site you have no guarantee that the files are unmodified
or uncompromised. Anyone providing a link to a non-vendors site with a
direct download should not be trusted, the vendors sites are the safest
place to download their application.

No person of sound mind would download files from a hack site that
requires a password to access the unknown files when they are available
directly from the vendors.

Always remember - only download files from Trusted Sites.

The following links will take you to vendors sites for Spy Ware / Ad
ware
removal tools and also for Antivirus tools. After you install any of
these applications and update them, run them in SAFE MODE to allow
them to properly clean your system.

These sites are for downloading Anti-Spyware tools, in order that I
would use them myself:

AdAwareSE can be found here:
http://www.lavasoft.de/support/download/

SpyBot Search and Destroy can be found here:
http://www.safer-networking.org/en/download/index.html

HiJack can be found here:
http://www.spywareinfo.com/~merijn/downloads.html

Ewido Security Suite Trial can be found here:
http://www.ewido.net/en/download/

CrapCleaner can be found at the vendors site here:
http://www.ccleaner.com/ccdownload.asp

CleanUp can be found at the vendors site here:
http://www.stevengould.org/software/cleanup/download.html
or from another reputable source:
http://www.tucows.com/get/405276_152071

The following are two links to Antivirus software in order that I would
use them:

You can also download Symantec Trial version of their Antivirus software
from here:
http://www.symantec.com/downloads/

Download AVG Personal Free edition from here:
http://free.grisoft.com/freeweb.php/doc/2/

These are the actual vendors sites, not some unknown or authorized no-
name site. They also don't artificially increase the hits for sites that
get paid for the amount of traffic they can generate like one poster has
admitted to in this group.

 

[Rick \Nutcase\ Rogers]

Hi,

Delete the entry that loads it from these keys in the registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

To do so, click start/run, type regedit and click ok. Expand the plus (+)
signs to reach the key and click on. Then look the the strings in the right
pane for the one that loads nail.exe. Click on that string and then hit
<delete>.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[JCO]

You should make your registry changes and deleted the nail.exe while in safe
mode.
I had this issue too. I believe you have to shut down a service (can't
remember which one) which can only be done in Safe Mode. Otherwise, every
time you delete something, the virus will re-created itself again. I'm
sure, if you do a Ctl Alt Del, you will be able to find a bogus exe running
too.

 

[JCO]

Also;
http://netrn.net/spywareblog/archives/2005/05/10/got-aurora-nailexe/

Here is NailFix.exe
http://gilbertwesleypurdy.blogspot.com/2005/11/how-to-remove-nailexe.html

http://www.justtext.com/remove-aurora/

 

[David H. Lipman]

From: "herbert feller" <[email protected]>

| I have removed C:\WINDOWS\Nail.exe from my computer.
| When I open windows I'm getting a pop up saying that C:WINDOWS\Nail.exe
| cannot be found. Why is this pop up doing that every time I open windows?
| How do I correct the problem?
|
| Thank you..........Herb
|

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *

 

[David H. Lipman]

From: "Rick "Nutcase" Rogers" <[email protected]>

| Hi,
|
| Delete the entry that loads it from these keys in the registry:
|
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
|
| To do so, click start/run, type regedit and click ok. Expand the plus (+)
| signs to reach the key and click on. Then look the the strings in the right
| pane for the one that loads nail.exe. Click on that string and then hit
| <delete>.
|


Nail.exe chains off Explorer.exe in the shell key...

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Shell=explorer.exe C:\WINDOWS\Nail.exe


The Multi AV Scanning tool that I wrote, and posted to be used, automatically fixes this.

 

[Guest]

I tried that, Did not find anything that indicated it was nails. Possibly I
did not search properly.....What do you mean expand the + sign and how would
I know what string loads nail.exe?

Thank you for the help
herrock