Spyware / Malware / Virus Removal
Aurora Clean-Up
9 min read
Page 1 of 2
Next →
This thread's last reply is from June 15, 2005, 2:17 AM UTC . Advice, software, and links
below may be out of date — treat specific steps and download links with caution.
Looking for the outcome? ✨ Ask AI
I 've had the nasty Aurora, but followed many recent threads for clean-up instructions. I think I'm ok, but would like to have an expert review my HJT log for this and/or other lurking maladies.
Hi fcmoore ,Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. Make double sure to disable Spybot's Tea Timer for now, as it can interfere with the fixing of problems . Spybot and and make sure you are in Advanced mode (check it in the 'Mode' menu). Go to the Tools section and click resident and then uncheck the box for Tea Timer. reboot Now let's do some work on your log: First we need to make all files and folders VISIBLE :Close all browser windows and RUN HijackThis .SCAN R3 - Default URLSearchHook is missing FIX checked button. Close the HijackThis window and Reboot Your System in Safe Mode How to use the F8 method to Start Your Computer in Safe Mode Using Windows Explorer , locate the following files/folders, and DELETE them (if they are present) :FILES taskmgn.exe msbb.exe gpojul.exe FOLDERS (with all their content) yclfnmta gfqw REBOOT BACK INTO NORMAL MODE RUN Hijackthis again and produce a new HJT log . Post it in the forum so we can check how everytjhing looks now.Regards,Trevuren
Thanks for your suggestions.
Let's go over part of this again,UNINSTALL SPYBOT (It occasionally must be done to allow the fixes)O2 - BHO: (no name) - {19AF3225-9410-1DB1-8559-675578F32A39} - (no file) We need to make all files and folders VISIBLE :REBOOT into Safe Mode (as previously described) DELETE the following files:msbb.exe gpojul.exe Trevuren
Trevuren:
Please click HERE to download System Security Suite . Extract it from the zip file into a folder and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. Reboot when prompted. Trevurren
After installing on Win XP Pro I cannot run System Security Suite 1.04. I get the message access violated at 0047616B in module sss.exe. I have tried to reinstall, but not luck.
Try
Cleanup which you can download from
HERE Trevuren
I have successfully loaded and run Cleanup or CCleaner. I still cannot remove these stubborn files. They appear to be fixed/earased in HJT when run in the safe mode, but when I come back to a regular reboot and run the log they show up again.
I purchased and ran Registry Mechanic and it manged to clean up the stubborn items we had trouble deleting. How are things looking now?
Hi again,First we need to make all files and folders VISIBLE :Close all browser windows and RUN HijackThis .SCAN O4 - HKLM\..\Run: [Microsoft Autofix Service] MSTFX.EXE FIX checked button. Close the HijackThis window and Reboot Your System in Safe Mode How to use the F8 method to Start Your Computer in Safe Mode Using Windows Explorer , locate the following file, and DELETE it (if it is present) :MSTFX.EXE REBOOT BACK INTO NORMAL MODE RUN Hijackthis again and produce a new HJT log . Post it in the forum so we can check how everytjhing looks now.Regards,Trevuren
Tevuren:
All Nice and Pretty fcmoore,
Congratulations , your new log shows that your
SYSTEM IS CLEAN There are a few things you must do once you are completely clean:
1.
Reset and Re-enable your System Restore to remove bad files from the backup that Windows makes as no program is able to clean those files:
TO DISABLE SYSTEM RESTORE
1. Right-click "My Computer", and then left click "Properties".
2. Left click on "System Restore Tab"
3. Check box beside "Turn Off System Restore"
4. Left click on "Apply"
TO ENABLE SYSTEM RESTORE
1.Remove check mark from "Turn Off System Restore"
2.Click on "Apply"
2.
Cleanup the leftovers . Download
CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
3. Finally,
Re-hide your System Files and Folders to prevent any future accidents. Here are some tips to reduce the potential for spyware infection in the future: Make sure you keep your Windows OS current by visiting
Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.
I strongly recommend installing the following applications :
Spywareblaster <= SpywareBlaster will prevent spyware from being installed. Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts. How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware. How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware. To protect yourself further :
IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer Google Toolbar <= Get the free google toolbar to help stop pop up windows. And also see TonyKlein's good advice
So how did I get infected in the first place? (My Favorite)
Regards,Trevuren
Trevuren:
I don't know what you did with that program you ran. I'll have to thing and researcg the problem/Trevuren
