# Aurora Malware: how to remove it? **URL:** \ **Category:** Factual Questions\ **Created:** [May 17, 2005, 8:24am UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210 "2005-05-17T08:24:37Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![FinnAgain](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finnagain/32/12500_2.png) [@FinnAgain](https://boards.straightdope.com/u/FinnAgain)\ **Post date:** [May 17, 2005, 8:24am UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/1 "2005-05-17T08:24:37Z")
I’ve got a particularly nasty bit of malware on my laptop, and I can’t seem to get rid of it. I’ve run deep scans with updated versions of Spyware Stormer and Ad Aware, and neither can seem to catch this thing. Aurora works by opening popups all over the damn place, asking me to buy certain things and bullshit of that sort. In the proess it slows my computer to a crawl. I searched the Dope, but there were no hits for “Aurora” and “malware” or “spyware.” I’ve also done some searching via google, and it seems there’s a program called Hijack This which can remove Aurora, but it’s only for advanced users. I know how to word process, email, and play a few video games, I’m certainly no advanced user. Any Dopers got any clues on how to beat this vile lil’ piece of malware? Or if Hijack This is the only way to get rid of it, could anybody explain to me how exactly I can go about doing so? Thanks for the time and attention! ---
**Author:** ![Caught\_Work](https://avatars.discourse-cdn.com/v4/letter/c/919ad9/32.png) [@Caught\_Work](https://boards.straightdope.com/u/Caught_Work)\ **Post date:** [May 17, 2005, 8:35am UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/2 "2005-05-17T08:35:00Z")
Google answers recommends this: [http://www.mypctuneup.com/evaluate.php?b=aurora](http://www.mypctuneup.com/evaluate.php?b=aurora) ---
**Author:** ![FinnAgain](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finnagain/32/12500_2.png) [@FinnAgain](https://boards.straightdope.com/u/FinnAgain)\ **Post date:** [May 17, 2005, 8:54am UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/3 "2005-05-17T08:54:32Z")
Excellent! Thank you, that seems to have done it. If you don’t mind me asking, what were your search terms? I ran searches for “aurora spyware” “aurora malware” and “remove aurora” but I didn’t find the program you listed. ---
**Author:** ![Whack-a-Mole](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/whack-a-mole/32/141_2.png) [@Whack-a-Mole](https://boards.straightdope.com/u/Whack-a-Mole)\ **Post date:** [May 17, 2005, 11:56am UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/4 "2005-05-17T11:56:12Z")
> [@FinnAgain](#): > > If you don’t mind me asking, what were your search terms? I ran searches for “aurora spyware” “aurora malware” and “remove aurora” but I didn’t find the program you listed. Kind of curious about that myself. I recently had a client’s PC infected with Aurora and it was a royal pain in the ass to get it off. The final solution was a multistep process using several different tools as well as some registry hacking. In fact, another engineer who had nothing better to do at the time joined me just to see what it was all about and he was amazed at it’s tenaciousness. Only other one I have seen as bad as Aurora is CoolWeb. Anyway, neither of us in all of our searching came across that tool as a solution and if (as seems suggested) it did the trick in one simple go I am amazed and impressed. I almost want to find another Aurora infected PC just to check it out. BTW…make sure NAIL.EXE is gone out of your C:\WINDOWS directory to be 100% sure Aurora is gone. That program seemed to be at the heart of it. Absolutley amazing to see that program re-appear after some pretty harsh attempts at deleting it couldn’t stop it from coming back. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [May 17, 2005, 12:38pm UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/5 "2005-05-17T12:38:58Z")
Don’t forget Spybot; run that as well as AdAware. I don’t know if it catches Aurora, but together those two dudes catch pretty much everything. And: > **[Have a Computer Question ? Read this first.](https://boards.straightdope.com/sdmb/showthread.php?t=260053)** > > Over the past few months we have received a spate of computer related questions in GQ, most of which can be solved by solutions given in this thread. The entire thread may be too long to read through, so please read through at least the first few... Using “Aurora malware” (without the quotes) to search in google gives this. Looks pretty comprehensive to me: [http://www.google.com/search?hl=en&q=aurora+malware&btnG=Google+Search](http://www.google.com/search?hl=en&q=aurora+malware&btnG=Google+Search) [Majorgeeks.com](http://Majorgeeks.com) has a good malware forum you might check out in the future. ---
**Author:** ![Whack-a-Mole](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/whack-a-mole/32/141_2.png) [@Whack-a-Mole](https://boards.straightdope.com/u/Whack-a-Mole)\ **Post date:** [May 18, 2005, 12:17pm UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/6 "2005-05-18T12:17:06Z")
> [@Musicat](#): > > Don’t forget Spybot; run that as well as AdAware. I don’t know if it catches Aurora, but together those two dudes catch pretty much everything. Trust me…Spybot and AdAware are not sufficient to kill Aurora. The dudes who make these things know that those two programs are popular and program to evade them. I had a CoolWeb one once that would see AdAware run and shut it down (I was kind of impressed despite being pissed off about it). When I got rid of Aurora I used the tools and procedures you found via Google (exactly that in fact) and it worked but it wasn’t a nice, one-stop, get rid of Aurora thing that the tool mentioned earlier is. ---
**Author:** ![Nanoda](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nanoda](https://boards.straightdope.com/u/Nanoda)\ **Post date:** [May 18, 2005, 6:51pm UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/7 "2005-05-18T18:51:03Z")
Um… no offence, but I’m pretty sure that ‘mypctuneup’ page is owned by malware creating companies. My brother had some browser add-on that re-directed the occasional google search to some other engine - when I called their number, they directed me to that place too. If you search around though, it’s believed that while the mypctuneup tool _does_ remove certain spyware, it installs others. So you may want to check, is all I’m saying. (Though perhaps the trade may be worth it). [Example site](http://www.doxdesk.com/parasite/rogues.html) ---
**Author:** ![Nanoda](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nanoda](https://boards.straightdope.com/u/Nanoda)\ **Post date:** [May 18, 2005, 6:56pm UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/8 "2005-05-18T18:56:06Z")
Um… no offence, but I’m pretty sure that ‘mypctuneup’ page is owned by malware creating companies. My brother had some browser add-on that re-directed the occasional google search to some other engine - when I called their number, they directed me to that place too. If you search around though, it’s believed that while the mypctuneup tool _does_ remove certain spyware, it installs others. So you may want to check, is all I’m saying. (Though perhaps the trade may be worth it). [Example site](http://www.doxdesk.com/parasite/rogues.html) ---
**Author:** ![Nanoda](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nanoda](https://boards.straightdope.com/u/Nanoda)\ **Post date:** [May 18, 2005, 7:01pm UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/9 "2005-05-18T19:01:06Z")
And it’s definately responsible for double-posts. ---
**Author:** ![Whack-a-Mole](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/whack-a-mole/32/141_2.png) [@Whack-a-Mole](https://boards.straightdope.com/u/Whack-a-Mole)\ **Post date:** [May 18, 2005, 8:02pm UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/10 "2005-05-18T20:02:06Z")
> [@Nanoda](#): > > If you search around though, it’s believed that while the mypctuneup tool _does_ remove certain spyware, it installs others. So you may want to check, is all I’m saying. (Though perhaps the trade may be worth it). > [Example site](http://www.doxdesk.com/parasite/rogues.html) This guy seems to think [mypctuneup.com](http://mypctuneup.com) is malware. > [@](#): > > On 12 May 2004, my new Yahoo email account had a Spam message advertisement that linked back to Traffix that are in partnership with the Transponder gang from advertising to installation of transponder and even their own adware. So, when using [mypctuneup.com](http://mypctuneup.com) to help uninstall their adware, you are allowing them to not only replace it with their other transponder variants but now they have your email address in which they can spam you. > > Source: [http://netrn.net/spywareblog/archives/2004/05/13/giving-your-email-to-mypctuneupcom-in-order-to-obtain-a-user-id-starts-spm-from-traffix/](http://netrn.net/spywareblog/archives/2004/05/13/giving-your-email-to-mypctuneupcom-in-order-to-obtain-a-user-id-starts-spm-from-traffix/) On another page at the same site… > [@](#): > > Note that they provide a tool to remove through an affiliate at [MYPCTuneup.com](http://MYPCTuneup.com). So if you remove Aurora with MyPCTuneup…. notice that you agree to allow them to install a web bug on your computer in exchange for utilizing their uninstall software.(second paragraph of their privacy policy) Also notice how their privacy policy langauge dances around to avoid responsibility regarding the collection of personally identifiable information about children under the age of 13. > > SOURCE: [http://netrn.net/spywareblog/archives/2005/05/10/got-aurora-nailexe/](http://netrn.net/spywareblog/archives/2005/05/10/got-aurora-nailexe/) ---
**Author:** ![FinnAgain](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finnagain/32/12500_2.png) [@FinnAgain](https://boards.straightdope.com/u/FinnAgain)\ **Post date:** [May 20, 2005, 9:46am UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/11 "2005-05-20T09:46:47Z")
Damn… I missed this therad for a while, thought it died. So you’re saying that the program I just downloaded, even though it said it was installing nothing, still fucked me over… any hints on how to remove that new malware? Ad Aware and Spybot proved innefective against Aurora… will they fare any better against this new one? ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [May 20, 2005, 1:26pm UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/12 "2005-05-20T13:26:50Z")
[Here is a thread at the Spyware Info forum](http://forums.spywareinfo.com/index.php?showtopic=48223) that explains how to remove this pest, including a new tool designed specifically for it. ---
**Author:** ![DrDeth](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@DrDeth](https://boards.straightdope.com/u/DrDeth)\ **Post date:** [May 20, 2005, 3:46pm UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/13 "2005-05-20T15:46:32Z")
Here’s the scoop on “mypctuneup”: [http://www.spywarewarrior.com/rogue\_anti-spyware.htm#products](http://www.spywarewarrior.com/rogue_anti-spyware.htm#products) ---
**Author:** ![FinnAgain](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/finnagain/32/12500_2.png) [@FinnAgain](https://boards.straightdope.com/u/FinnAgain)\ **Post date:** [May 21, 2005, 3:22am UTC](https://boards.straightdope.com/t/aurora-malware-how-to-remove-it/304210/14 "2005-05-21T03:22:58Z")
Thanks for all the help! Stooooopid malware.