vxdsrv.exe DOES NOT Respond to Safe Mode and Full Scan

[Guest]

This one looks nasty. Any help is really appreciated

 

[Bill Sanderson]

You need either Ron Kinner and HijackThis logs, or a specialized forum and
the same logs--for a forum, follow the protocol here:

http://www.aumha.org/a/quickfix.htm

 

[Guest]

Thank you for your help. I'm rid of it except while in
safe mode, I go through all System Explorers removing
this thing. It was in the start up folder, registries
and winlogon shell. Removed it from all except when I
get to Winlogon shell, the "Block this start up program"
from Anti Spyware doesn't highlight and therefore,
vxdsrv.exe won't go.

 

[Bill Sanderson]

Are you seeing popups labelled Aurora?

Here's the registry location I believe is involved:

HJEY_LOCAL_MACHINE\SOFTWARE\Microsoft|Windows NT\CurrentVersion\Winlogon

Look at the Shell value--it should have Explorer.exe and nothing else in it.

It won't hurt to search the registry on "nail.exe" either.

You have found a file which is active even in safe mode, I suspect. One
approach to this is to use killbox:

http://www.bleepingcomputer.com/files/killbox.php

Another is to boot to the recovery console by booting with your original
Windows CD--use some care--this facility may not exist on some OEM recovery
CD's--and choosing R at the first prompt to start the recovery console.
This is a command line separate recovery facility which can see certain
parts of your installed Windows. It happens that this bug lives in the
parts it can see. You will definitely be able to delete this file from the
recovery console.