Title: Aurora

Type: Adware

Remove Aurora. Removal instructions

Severity scale:

(47 / 100)

Aurora is classified as adware. This program's functions include monitoring your online activities and sending it's observations to third-party servers for analysis. Aurora is also responsible for displaying pop-up advertisements.

Aurora is a threat and as such should be removed upon detection.

Related files: Nail.exe, svcproc.exe, DrPMon.dll, iddjhjm.ini

Aurora properties:
• Shows commercial adverts
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic Aurora removal:

remover for Aurora

SpyHunter is recommended remover to uninstall Aurora. You should confirm using free trial that it detects current version of parasite.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove Aurora using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

We are testing STOPzilla's efficiency at removing Aurora (2007-12-19 06:41:51)

Malwarebytes Anti Malware

download | review

We are testing Malwarebytes Anti Malware's efficiency at removing Aurora (2007-12-19 06:41:51)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing Aurora (2007-12-19 06:41:51)

XoftSpySE Anti Spyware

download | review

Aurora manual removal:

FORUM:
Discuss Aurora in
spyware removal forum

Kill processes:
nail.exe, svcproc.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe %Windir%\nail.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[random name]
HKEY_CURRENT_USER\Software\aurora
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SvcProc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\abi-1

HELP:
how to remove registry entries

Unregister DLLs:
drpmon.dll

HELP:
how to unregister malicious DLLs

Delete files:
nail.exe, svcproc.exe, drpmon.dll, iddjhjm.ini

HELP:
how to remove harmful files

Information added: 2005-05-28 03:30:53
Information updated: 2007-12-19 04:04:36

Additional resources related to Aurora:

Attention: If you know or you have a website or page about Aurora removal, feel free to add a link to this list: add url

more resources

Guest

Hi
Hope you can help me!!
My pc my antiapyware detect this infection but as you can see it have reached the restore files, what can i do to delete this files??????
c:windowssystem32drpmon.dll
c:system volume information_restore{5888c98e-316a-44e3-964e-1cd9b2613d9d}rp5a0000311.dll

C:WINDOWSsvcproc.exe
c:system volume information_restore{5888c98e-316a-44e3-964e-1cd9b2613d9d}rp5a0000309.exe

any clue, please e-mail me at: alan1976@terra.com.mx

Reply »

2005 06 03

Guest

I also had a virus file from Aurora.exe called win32.bettInet also a program called nail.exe was installed. How I got all this I do not know.

Reply »

2005 06 09

Guest

Hi,

I have downloaded and tried 20 anti spyware removal tools in the last 2 days. I use kaspersky anti virus and nothing I mean nothing I do is getting rid of this aurora.exe or more technically poller.exe virus. Each time the virus pops so does the aurora. Please can someone help me?

Thank You,
Wendy
honestyemail@yahoo.com

Reply »

2005 07 11

Guest

Has anyone found away to remove Nail.exe?

I can remove the others but they all just come back. I cant believe people can get away with this form of viruses.

Reply »

2005 07 20

Guest

what in the world do they think the pop ups will accomplish....It just makes us mad, like we would ever visit what they are advertizing.....I have never delt with anything more annoying then this Aurora....It should be illegel and they should be able to prosicute these idiots....

Reply »

2005 07 28

Guest

You should post on here that there is a fee for the aurora removal tool.

Reply »

2005 08 13

Guest

http://cpcug.org/user/clemenzi/technical/Parasites/abi_virus.html#Uninstall_2

Reply »

2005 08 21

Guest

i could delete Aurora Spyware using a simple program named XoftSpy it`s very easy and free in just 2 or 3 minutes this malaware dissapear

Reply »

2005 08 21

Guest

all it does is reinstall Aurora !!!

Reply »

2005 08 22

Guest

worked for me, besides if it reinstalled then ide be in the same place as before. what a bunch of nonsense, to think the uninstall was merely a ploy to install 2x! Like the program doesnt replicate on its own. I say if you are infected then nothing to lose, Right!!

Reply »

2005 08 23

Guest

To get rid of nail.exe, first boot into safe made (press f8 when rebooting at the point right after POST). When running create a dummy nail.exe file: In a folder other than windows right-click and create a new text file. Leave it empty then rename it nail.exe. Then right click and make it read-only. Right-click on it again and copy. Then go to the windows folder delete the existing nail.exe file and paste the one you created. This has to be done fairly quickly or the bad nail.exe will reappear. After that you can have your revenge on Aurora. This has worked a lot of times for me...

Reply »

2005 10 18

Post Comment:

Attention: Use this form only if you have additional information about Aurora parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.