G
Guest
This one looks nasty. Any help is really appreciated
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.
You should upgrade or use an alternative browser.
B
Bill Sanderson
You need either Ron Kinner and HijackThis logs, or a specialized forum and
the same logs--for a forum, follow the protocol here:
http://www.aumha.org/a/quickfix.htm
the same logs--for a forum, follow the protocol here:
http://www.aumha.org/a/quickfix.htm
G
Guest
Thank you for your help. I'm rid of it except while in
safe mode, I go through all System Explorers removing
this thing. It was in the start up folder, registries
and winlogon shell. Removed it from all except when I
get to Winlogon shell, the "Block this start up program"
from Anti Spyware doesn't highlight and therefore,
vxdsrv.exe won't go.
safe mode, I go through all System Explorers removing
this thing. It was in the start up folder, registries
and winlogon shell. Removed it from all except when I
get to Winlogon shell, the "Block this start up program"
from Anti Spyware doesn't highlight and therefore,
vxdsrv.exe won't go.
B
Bill Sanderson
Are you seeing popups labelled Aurora?
Here's the registry location I believe is involved:
HJEY_LOCAL_MACHINE\SOFTWARE\Microsoft|Windows NT\CurrentVersion\Winlogon
Look at the Shell value--it should have Explorer.exe and nothing else in it.
It won't hurt to search the registry on "nail.exe" either.
You have found a file which is active even in safe mode, I suspect. One
approach to this is to use killbox:
http://www.bleepingcomputer.com/files/killbox.php
Another is to boot to the recovery console by booting with your original
Windows CD--use some care--this facility may not exist on some OEM recovery
CD's--and choosing R at the first prompt to start the recovery console.
This is a command line separate recovery facility which can see certain
parts of your installed Windows. It happens that this bug lives in the
parts it can see. You will definitely be able to delete this file from the
recovery console.
Here's the registry location I believe is involved:
HJEY_LOCAL_MACHINE\SOFTWARE\Microsoft|Windows NT\CurrentVersion\Winlogon
Look at the Shell value--it should have Explorer.exe and nothing else in it.
It won't hurt to search the registry on "nail.exe" either.
You have found a file which is active even in safe mode, I suspect. One
approach to this is to use killbox:
http://www.bleepingcomputer.com/files/killbox.php
Another is to boot to the recovery console by booting with your original
Windows CD--use some care--this facility may not exist on some OEM recovery
CD's--and choosing R at the first prompt to start the recovery console.
This is a command line separate recovery facility which can see certain
parts of your installed Windows. It happens that this bug lives in the
parts it can see. You will definitely be able to delete this file from the
recovery console.