None of the Solutions for Aurora(Nail.exe) on Symantec website
or http://netrn.net/spywareblog/archives/2...a-nailexe/
have worked for me.
This worked though.
Turn off System Restore
Updated virus definitions
Restart in Safe Mode
Log on as admin
Open Windows explorer
Go to Tools/Folder Options/View/Unhide all files including system files
Go to C:\RECYCLER and delete all files except for the current days dated file
Then go to each user?s EXAMP: C:\Documents and Settings\Admin\Local Settings
And delete all Temp files and Temporary Internet Files
Then go to C:\Windows\Prefetch select all files there and delete
Then go to C:\Program Files\Common Files see if there are any folders that have Aurora or Better Internet or something to do with the Adaware or virus, if so delete it.
Empty the recycle bin on the desktop.
Go to Add/Remove programs and remove all unauthorized programs.
Go to Start/Run and type ?regedit? Delete the following entries that the threat adds to the registry
HKEY_CURRENT_USER\Software\aurora
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\abi-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SvcProc
Also delete the random entry under the registry subkey
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"[RANDOM NAME]" = "%System%\[RANDOM NAME].exe r"
Restore the following entry.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
From this
"Shell" = "Explorer.exe %Windir%\Nail.exe"
To this
"Shell" = "Explorer.exe"
Restart computer in normal mode and run Antivirus, Full Scan
All was clear.