C
Carl
I can't get rid of the nail.exe virus even though I have
scanned the PC with the Microsoft spyware removal
program. What to do?
scanned the PC with the Microsoft spyware removal
program. What to do?
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.
You should upgrade or use an alternative browser.
A
Andre Da Costa
From Andy:
Aurora isnt easy to remove follow the fix below and email
me if you have any problems
Upon running Aurora.exe, the following items are created:
- Deletes Aurora.exe & creates
C:\WINDOWS\Nail.exe, then a chain reaction:
C:\WINDOWS\system32\Poller.exe, which creates
C:\WINDOWS\system32\magihjz.exe [random filename]
C:\WINDOWS\svcproc.exe
C:\WINDOWS\tdtb.exe
C:\WINDOWS\qvbdnifharv.exe
C:\WINDOWS\dbwqis.exe
C:\WINDOWS\GGEEINPO.ini
C:\WINDOWS\system32\magihjz.exe
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER
C:\WINDOWS\lu.dat
C:\WINDOWS\kwv2.dat
C:\WINDOWS\kwv2Temp.dat
C:\WINDOWS\wupdt.exe
C:\WINDOWS\TMP_FILE_0.tmp
C:\WINDOWS\TMP_FILE_1.tmp
C:\WINDOWS\system32\Macromed\Flash\testUpdate.txt
Populates Internet Explorer cache with ads and tracking
cookies, and populates the user's Temp folder.
Creates a Run entry in
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersi
on\Run for wupdt.exe & magihjz.exe so that it runs when
the user restarts.
Nail.exe generates "exe" files in the System folder
with random names,they will be 74kb in size and have TODO
writen when you right click and view properties.svcproc
is running as a windows sevice,bolger.dll installs as a
BHO
Looking at ABetterInternet's EULA :
----------------------------------------------------------
Uninstall and Remove Software - You may uninstall the
Software at any time by visiting www.mypctuneup.com.
Visiting www.mypctuneup.com is the primary method to
properly remove the Software. MyPCTuneUp will leave
behind a unique identifier on your computer for the sole
purpose of notifying ABI that you no longer want the
Software to operate on your computer.
This comes from BetterInternet though (makers of Aurora)
"The MyPCTuneUp uninstaller program will never collect
any personally identifiable information, it will not
install any additional programs, and it will delete
itself once it finishes the uninstall process."
Yet the EULA says
"Visiting www.mypctuneup.com is the primary method to
properly remove the Software. MyPCTuneUp will leave
behind a unique identifier on your computer for the sole
purpose of notifying ABI that you no longer want the
Software to operate on your computer."
Contradicts big time but if your infected you dont have
much to lose it could fix it fast for you.
To go for this manually heres the best way:
I know this involves alot
of programs but i dont think any of the scanners alone
will remove this yet.
For Aurora Use This Fix
----------------------------------------------------------
For Xp Download Nailfix
http://xsorbit26.com/users5/andymanchesta/index.php?
action=dlattach;topic=3261.0;id=294
Download the Remover to your desktop
windows 2000 download nailfix2k
http://xsorbit26.com/users5/andymanchesta/index.php?
action=dlattach;topic=3261.0;id=295
----------------------------------------------------------
Download The ABI remover (Better Internet Remover)
http://xsorbit26.com/users5/andymanchesta/index.php?
action=dlattach;topic=3240.0;id=292
Download the Remover to your desktop
----------------------------------------------------------
Download latest Hijackthis and unpack it in its own folder
(either desktop or c/drive)
http://www.spywareinfo.com/~merijn/files/hijackthis.zip
----------------------------------------------------------
Download Ewido Security Suite
http://download.ewido.net/ewido-setup.exe
----------------------------------------------------------
Download Ccleaner
http://download.ccleaner.com/download119bin.asp
----------------------------------------------------------
Reboot into Safe Mode by hitting the F8 key repeatedly
until a menu shows up (and choose Safe Mode from the list)
start the ABIRemover.exe, press install, wait (explorer
window will disapear)
in Safe Mode, please double-click on nailfix.bat (or
nailfix2k.bat if you have Windows 2000). Your desktop and
icons will disappear and reappear, and a window should
open and close very quickly.
Next run a full scan in Ewido
Hopefully this will kill this but you can check for
entries in hijack this,Reboot and run hijack this,choose
to run a scan and save the logfile,The entries related to
this are these:
F2 - REG:system.ini: Shell=Explorer.exe
C:\WINDOWS\Nail.exe
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-
1645A0B08410} - C:\WINDOWS\Bolger.dll
O4 - HKLM\..\Run: [hjnyDA] C:\WINDOWS\kkuibquo.exe (this
file changes it's name - but it will
be in the same place in the log)
O23 - Service: System Startup Service (SvcProc) - Unknown
owner - C:\WINDOWS\svcproc.exe
If you find them put a tick beside them in hijack this
close all windows and choose fix checked
run a online virus scan to check for any other malware
Trend Micro http://housecall.antivirus.com/
Panda
http://www.pandasoftware.com/activescan/co...n_principal.h
tm
If you are clean again you can delete nailfix,ewido and
ABI remover if not post the hijack this log either on
here or to my email
Andy
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
Aurora isnt easy to remove follow the fix below and email
me if you have any problems
Upon running Aurora.exe, the following items are created:
- Deletes Aurora.exe & creates
C:\WINDOWS\Nail.exe, then a chain reaction:
C:\WINDOWS\system32\Poller.exe, which creates
C:\WINDOWS\system32\magihjz.exe [random filename]
C:\WINDOWS\svcproc.exe
C:\WINDOWS\tdtb.exe
C:\WINDOWS\qvbdnifharv.exe
C:\WINDOWS\dbwqis.exe
C:\WINDOWS\GGEEINPO.ini
C:\WINDOWS\system32\magihjz.exe
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER
C:\WINDOWS\lu.dat
C:\WINDOWS\kwv2.dat
C:\WINDOWS\kwv2Temp.dat
C:\WINDOWS\wupdt.exe
C:\WINDOWS\TMP_FILE_0.tmp
C:\WINDOWS\TMP_FILE_1.tmp
C:\WINDOWS\system32\Macromed\Flash\testUpdate.txt
Populates Internet Explorer cache with ads and tracking
cookies, and populates the user's Temp folder.
Creates a Run entry in
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersi
on\Run for wupdt.exe & magihjz.exe so that it runs when
the user restarts.
Nail.exe generates "exe" files in the System folder
with random names,they will be 74kb in size and have TODO
writen when you right click and view properties.svcproc
is running as a windows sevice,bolger.dll installs as a
BHO
Looking at ABetterInternet's EULA :
----------------------------------------------------------
Uninstall and Remove Software - You may uninstall the
Software at any time by visiting www.mypctuneup.com.
Visiting www.mypctuneup.com is the primary method to
properly remove the Software. MyPCTuneUp will leave
behind a unique identifier on your computer for the sole
purpose of notifying ABI that you no longer want the
Software to operate on your computer.
This comes from BetterInternet though (makers of Aurora)
"The MyPCTuneUp uninstaller program will never collect
any personally identifiable information, it will not
install any additional programs, and it will delete
itself once it finishes the uninstall process."
Yet the EULA says
"Visiting www.mypctuneup.com is the primary method to
properly remove the Software. MyPCTuneUp will leave
behind a unique identifier on your computer for the sole
purpose of notifying ABI that you no longer want the
Software to operate on your computer."
Contradicts big time but if your infected you dont have
much to lose it could fix it fast for you.
To go for this manually heres the best way:
I know this involves alot
of programs but i dont think any of the scanners alone
will remove this yet.
For Aurora Use This Fix
----------------------------------------------------------
For Xp Download Nailfix
http://xsorbit26.com/users5/andymanchesta/index.php?
action=dlattach;topic=3261.0;id=294
Download the Remover to your desktop
windows 2000 download nailfix2k
http://xsorbit26.com/users5/andymanchesta/index.php?
action=dlattach;topic=3261.0;id=295
----------------------------------------------------------
Download The ABI remover (Better Internet Remover)
http://xsorbit26.com/users5/andymanchesta/index.php?
action=dlattach;topic=3240.0;id=292
Download the Remover to your desktop
----------------------------------------------------------
Download latest Hijackthis and unpack it in its own folder
(either desktop or c/drive)
http://www.spywareinfo.com/~merijn/files/hijackthis.zip
----------------------------------------------------------
Download Ewido Security Suite
http://download.ewido.net/ewido-setup.exe
----------------------------------------------------------
Download Ccleaner
http://download.ccleaner.com/download119bin.asp
----------------------------------------------------------
Reboot into Safe Mode by hitting the F8 key repeatedly
until a menu shows up (and choose Safe Mode from the list)
start the ABIRemover.exe, press install, wait (explorer
window will disapear)
in Safe Mode, please double-click on nailfix.bat (or
nailfix2k.bat if you have Windows 2000). Your desktop and
icons will disappear and reappear, and a window should
open and close very quickly.
Next run a full scan in Ewido
Hopefully this will kill this but you can check for
entries in hijack this,Reboot and run hijack this,choose
to run a scan and save the logfile,The entries related to
this are these:
F2 - REG:system.ini: Shell=Explorer.exe
C:\WINDOWS\Nail.exe
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-
1645A0B08410} - C:\WINDOWS\Bolger.dll
O4 - HKLM\..\Run: [hjnyDA] C:\WINDOWS\kkuibquo.exe (this
file changes it's name - but it will
be in the same place in the log)
O23 - Service: System Startup Service (SvcProc) - Unknown
owner - C:\WINDOWS\svcproc.exe
If you find them put a tick beside them in hijack this
close all windows and choose fix checked
run a online virus scan to check for any other malware
Trend Micro http://housecall.antivirus.com/
Panda
http://www.pandasoftware.com/activescan/co...n_principal.h
tm
If you are clean again you can delete nailfix,ewido and
ABI remover if not post the hijack this log either on
here or to my email
Andy
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
A
AndyManchesta
Cheers Andre .That fix works well
Also turn off system restore before running any fixes
(Goto start > right click my coputer > choose properties
Re-enable only when you get clean by following the above
and unchecking 'turn off system restore' then press Apply.
You can also check the announcments area of this site on
the first page there is more removal methods which have
been posted by other user's as well as myself i think the
subject is c:\windows\nail so that will give you some
other options and info.
Good Luck
Andy
Also turn off system restore before running any fixes
(Goto start > right click my coputer > choose properties
restore' then press apply)then system restore > check the box 'turn off system
Re-enable only when you get clean by following the above
and unchecking 'turn off system restore' then press Apply.
You can also check the announcments area of this site on
the first page there is more removal methods which have
been posted by other user's as well as myself i think the
subject is c:\windows\nail so that will give you some
other options and info.
Good Luck
Andy