My PC is INFECTED!!!

Aurora pop-ups keep coming, and I have the nail.exe program in my windows folder. My windows media player and internet explorer won't run, so I'm using mozilla firefox. I have security task manager, and everytime I run it, there is this thing called "TODO: <File Description" and I can't get rid of it. I have HJT, but I'll post when you want me to. If ANYONE can help me cure my PC, I would be so grateful. Thanks

 

First:
Click Start > Run > type in regedit

Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Delete the value, Nail.exe and exit Registry Editor

NEXT:
Click Start > Run > type in cmd

Type in the following:
Nail.exe /FullRemove

Second:
Now, lets take care of the Aurora problem.

Download and run the uninstaller.

Download Here!

After you run this tool, reboot and then procede with the next step.

Third:
Run these online scans, post your results as in what was found and if it was removed or not.

TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

After running the above scans, reboot and procede with the next step!

Fourth:
http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

Thank you sooooooo much. This forum is the best!

Ok, I've scanned with housecall and found the following:
HTML: COOLWEB.A
JAVA BYTEVER.A
TROJ VIVIA.E
TROJ VIVIA.E
TROJ AGEN.ABS
TROJ NAIL.A

I managed to delete all but the first two, because the first two were in use or something.

The Trojan site was not working on my PC, but I do have the Trojan destroyer. I used it and deleted BOLGER.DLL, ZETA.EXE, and NAIL.EXE

I tried the Aurora uninstaller and it said it was uninstalled, but when I rebooted, I still got the aurora pop-ups. I don't think it works.

I also tried the regedit and cmd, but I don't think that worked either. when I type Naill.exe/FullRemove, nothing happens. Is something supposed to?

When I attached my HJT log.

THANK YOU SO MUCH!

 

Please EXTRACT HijackThis from the ZIP File to a Safer location. Here's how:

To create a new folder:
Click START > My Computer > Local Disc C: > Program Files
Now, RightClick on an Empty Area and select New > Folder & name it HijackThis and ENTER

To Extract HijackThis:
Now, Right Click your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder
(C:\Program Files\HJT) and click Next.

The reason HJT needs its own safe folder is so that backups will be safely preserved. That way, if a mistake is made in the removal process, the mistakenly deleted entry can be restored.


Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Now, look in Task Manager (Ctrl-Alt-Del) for the following running process and, if you see it, try to END it:

zvncmi.exe

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://snesorama.net
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)

O4 - HKLM\..\Run: [USB controller] "C:\DOCUME~1\Tavi\LOCALS~1\Temp\ICD2.tmp\svcmm32.exe" /startup
O4 - HKLM\..\Run: [oevbiaj] c:\windows\system32\zvncmi.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/Bridge-c135.cab
O16 - DPF: {2F5B39C5-C6F5-447A-A946-48B382C53985} - http://www.pacimedia.com/install/pcs_0002.exe
O16 - DPF: {539DA0E0-74A7-11D9-9669-0800200C9A66} - http://www.ouchvideo.com/mmviewer_ic13.cab
O16 - DPF: {5F3B3060-09E0-44C6-86F7-BC7B02B57BEE} - http://downloads.shopathomeselect.com/vrmedia/grinstall_vrmedia1001.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0018.exe
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab

O20 - AppInit_DLLs: ,

O23 - Service: InCD Helper (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: RaySatxsi4_0 Server (RaySatxsi4_0Server) - Unknown owner -C:\Softimage\XSI_4.0\Application\bin\raysatxsi4_0server.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - Unknown owner - C:\WINDOWS\wanmpsvc.exe (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Click Start > Run > type services.msc and Click OK

Locate System Startup Service (SvcProc) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Documents and Settings\Tavi\Local Settings\Temp <-- Delete everything in this folder!

C:\WINDOWS\System32\zvncmi.exe

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

After doing ALL of the above, Scan with HijackThis and attach the new log.

 

Okay, thank you. Stange though, I did not find zvncmi.exe and it did not show up in HJT. (??) I guess that's a good thing though, huh? Thanks so much again.

 

Reboot into Safe Mode and run HJT, have it fix the below entries:

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O23 - Service: RaySatxsi4_0 Server (RaySatxsi4_0Server) - Unknown owner -C:\Softimage\XSI_4.0\Application\bin\raysatxsi4_0server.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

Reboot into Normal Mode! After you remove the above entries you should be ok. Are you having any furhter problems?

 

Oh gosh, thank you so much! My computer seems to be clean! However, my windows media player and internet explorer will not open (along with some other programs). Whenever I open them, they don't crash, they just automatically close without warning or anything. Do you have any ideas what could be wrong? Do you know of any software that causes this? Thanks again, you guys are so great!

 

Found the problem! I tried uninstalling my kaspersky anitvirus, and everything is back to normal again. Spread the word! Kaspersky can cause problems! Thanks for all you help!

 

Glad everything is ok now!

You should see this article on How to Protect yourself from malware!