Aurora manual removal:
Kill processes:
nail.exe, svcproc.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe %Windir%\nail.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[random name]
HKEY_CURRENT_USER\Software\aurora
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SvcProc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\abi-1
Unregister DLLs:drpmon.dll
Delete files:nail.exe, svcproc.exe, drpmon.dll, iddjhjm.ini
Post Comment:
Attention: Use this form only if you have additional information about Aurora parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.
Comments from visitors:
1. by Guest. 2005-10-18 11:10:42
I can remove the others but they all just come back. I cant believe people can get away with this form of viruses.
I have downloaded and tried 20 anti spyware removal tools in the last 2 days. I use kaspersky anti virus and nothing I mean nothing I do is getting rid of this aurora.exe or more technically poller.exe virus. Each time the virus pops so does the aurora. Please can someone help me?
Thank You,
Wendy
honestyemail@yahoo.com
Hope you can help me!!
My pc my antiapyware detect this infection but as you can see it have reached the restore files, what can i do to delete this files??????
c:windowssystem32drpmon.dll
c:system volume information_restore{5888c98e-316a-44e3-964e-1cd9b2613d9d}rp5a0000311.dll
C:WINDOWSsvcproc.exe
c:system volume information_restore{5888c98e-316a-44e3-964e-1cd9b2613d9d}rp5a0000309.exe
any clue, please e-mail me at: alan1976@terra.com.mx