Transponder.ABetterInternet.Aurora Adware

  • Thread starter Thread starter Connie
  • Start date Start date
C

Connie

Every night i run Antispyware and for some reason or
another it does not remove this particular bug... I even
downloaded spy net and with that again.. didn't remove..
is there any way i can delete this???? Help
 
See the .announcements group, messages from Aug 14, for a
message/thread started by Andy Manchesta with a solution
to this issue.
 
Make certain to remove any files in c:\windows\prefetch
(XP only) that contain the string abetterineternet. If
my memory is correct, they should start with
IEXPLORE.EXE. The reason is that the spyware has linked
code in the prefetch folder to IE. If there are files in
this folder with abetterinternet, then when you launch
IE, you will get reinfected with ABetterInternet. The
same happened to me until I used Windows' Search feature
and found the files there. Make absolutely certain to
close any web browser windows or this WILL NOT work!

The code in the prefetch folder is used by Windows to
speedup the launching of applications. The entire name
prefetch means code that is fetched before launching the
application in order to speedup the launching of the
application. Unfortunately, spyware/malware writers, and
other damaging program writers, have become wise to the
prefetch folder, and are starting to place code there to
hopefully reinfect systems that have been cleaned of the
infection.

I think MSAS IS removing ABetterInternet. However, if
you launch the application that the spyware has linked
code to, you will get reinfected by that spyware.

Alan
 
Hey Alan,

I just delete the whole contents of the prefetch folder
when cleaning malware as the genuine entries as soon
replaced there's tons left in there for all the parts to
Aurora, (Nail, Banner, rramcx, ffsnvqmgpiy, Poller,
Svcproc,Epolvy,drpmon etc..) so its easier to just do
away with the contents of the folder,

MSAS cannot remove Aurora and doesnt block it entering
the system with real time enabled. It doesnt detect
Nail,Svcproc,rramcx,ffsnvqmgpiy(This one is the pop up
window for Aurora) or the Epolvy random named entry but
does detect drpmon.dll but that just gets replaced when
MSAS deletes it,

Its debatable if it ever deletes it Im not convinced
myself but either way Epolvy is the main infectant and
replaces the others if they get removed so that needs
suspending and everything removing at the same time if
you try delete Epolvy(Random named file in the system
folder)it will be instantly replaced even in safe mode
its maybe called from prefetch or temp folders as there
is poller entries there which do not appear anywhere else
on the system but could be just written to replace itself
if it gets removed,

Nail cannot be removed in normal mode because its hooked
into explorer.exe so explorer needs suspending to remove
the infection, Its nasty stuff and Ive not seen any
remover that can do this fully except Adaware's new VX2
cleaner that works excellent, There is also nailfix that
kills explorer then removes the files and starts explorer
again but that doesnt target Epolvy so safe mode is
needed followed by Ewido and Ccleaner to remove all the
temp files for this but it still doesnt repair the
explorer=nail entry , Then there's Kill Epolvy that uses
the process suspend method and replaces the file on
reboot but that doesnt target the rest.

Spybot,Ewido,MSAS fails on Aurora , Adaware couldnt
remove it with thier scanner but the VX2 cleaner works
great as its all done on reboot after explorer.exe ends
then running Adaware's scanner gets the reg entries when
the machine reboots.

I think Aurora got changed towards the end of July as it
got abit harder to remove it and MSAS used to remove nail
and svcproc but doesnt now so they are trying to keep
ahead of the spyware scanners in my view. Its getting
bundled with other junk now as well and they can all
protect each other from being removed so things can get
difficult if it brings its mates ;)

For now though Adaware's new beta cleaner is the easiest
fix for this and Ive infected a machine with Aurora over
40 times in the last few weeks to try out different fixes
and batch files so I dont think Im being unfair to any
remover, Ive checked them all in detail and know how much
of a pain it can be. Kill Epolvy and Nailfix took many
hours of work for everyone involved but I'm not sure they
are needed now Lavasoft have come up with this cleaner,

MSAS fell behind when Aurora changed and still hasnt
started detecting it fully again but Im sure it will not
take them long to add it to thier definitions when they
realize its not being removed anymore.

Regards Andy
 
I downloaded the trial version of Giant AntiSpyware just
days before MS bought out Giant Company.

When I scanned my system, it detected ABetterInternet. I
told it to delete it. The next day, it was deteced once
again. I then deleted it once more. This kept happening
for a few days until I decided to search my hard drive to
see if any files contained the string abetterinternet.
All of them were in the prefetch folder. Each one was
linked to IE. Some might have been linked to Firefox, I
just can't remember, as it was almost 10 months ago when
I was infected. Once I deleted the entire prefetch
folder, the detect-delete-redetect-redelete cycle finally
ended.

I think that MSAS can remove ABetterInternet. Thing is,
if someone has an open browser, or even svchost.exe (one
associated with Browser service) is running, then the
deletion will likely fail. The reason for this is if any
of these two items are running, the files in the prefetch
folder are tied up by either the browser or svchost.exe,
making it impossible to remove those files. Also, even
if it is removed, if you have not deleted the files from
the prefetch folder, when you launch the application(s)
that are associated with the code the spyware has placed
in the prefetch folder, you will get reinfected if you
are connected to the Internet.

In other words, it might be best to try to remove
ABetterInternet from within Safe Mode. That way, only
critical system processes are running, allowing you to
remove much more than would be possible while in Normal
Mode.

Alan
 
I agree with you Alan it always helps to do things in
safe mode to stop the never ending cycle of detecting and
deleting the same files, They can be very time consuming
so its best to make things abit easier and run the fixes
in safe mode,

I remember ABI used to damage the wininit.ini file and
place the installers in temp files then the wininit would
load them when the system booted so they are forever
coming up with new tricks to force thier unwanted junk on
to people. Ive see alot of legitimate sites recently
advertising Luke the screen washer from ABI and that
installs Ceres so its going to be around for a long time
and they will keep these types of forums busy helping
users to remove the junk

As always if you uninstall the program it came with such
as Luke the screen washer Ceres stays on the system same
with the new Freephone which comes with Ceres or Aurora
if you remove the freephone it still leaves the junk to
deal with so they are a pain but they are not alone
there's alot of them companies about which make a
business out of tricking people. Luckily some of us like
yourself have been there before so we can help other
users who have problems once we know the infected area's.

Regards

Andy
 
Back
Top