Hi Plun
Here's my view of mypctuneup
The first time with just Aurora running did seem to
remove everything and I could find no traces
The second time with just Aurora running didnt fully
remove the infection and left the registry entries in
place also left the random named file (Epolvy) which then
returned all the other junk over about 30 minutes.
The third time, It didnt fully remove Aurora and was
still showing pop ups even though nail,svcproc and epolvy
had been removed, the file's ffsnvqmgpiy.exe & rramcx.exe
was still present in the windows folder and the Aurora &
svcproc reg entries but I made it abit hard on them by
having Aurora,Ceres & Mxtarget running but it was
suprising that it was able to show pop ups without the
Hijack This entries showing,
The forth time I had Aurora and Ceres and it removed
Aurora's but only removed the Ceres BHO registry entry
and the uninstall reg entry which made it look like it
was removed. Ceres.dll and the Ceres software registry
entries were still present.
Next I set up packet sniffers and that shows pretty much
everything you do while thier adware is on the system is
sent to them:
The Computer Registration Number & Username,
The version of Windows and Browser installed
How much space is used and what is free on the system
Every program installed and the paths to the files
Every entry you type in Search Engines
Every Page you visit
Every Download you do from any site
A good example of this in action is the new Aurora. In
some cases Aurora now hides the icons and folder for
Nailfix when its downloaded so it cannot be found. Its
the Nail.exe part that is doing this as its still hidden
in safe mode but the file can still be found using the
search feature so its shows they are aware of people's
attempts to remove this.
By using the uninstaller program from mypctuneup you then
give DR if they didnt have this already your ISP & IP
address plus it leaves what they descibe as the Marker on
the system so it then gives them complete information
about the user when you see all the information they take
when the adware is active,
I cannot find any malicious intent behind thier
uninstaller program but it uses THinstaller which
transmits data from the pc to them but in the tests I did
it was sometimes removing it and sometimes leaving traces
so this is enough reason for me not to recommend anyone
uses thier site, They are just playing a game and people
should find alternative ways to remove thier junk than
give them the satifaction of infecting the pc then taking
even more data from the machine in removing it
Andy
