Re: Strange problem

It sounds like you have been infected with the Aurora adware. Look for
svcproc.exe in \system32 or \windows and for nail.exe in \windows. If it is
there, you have Aurora.

Yeah, both are there. Thanks for the advice. I'll work on it tomorrow and
post back. Thanks again.









"wyocowboy" <wyocowboy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A1881806-2A96-4E55-AEAA-4956629E7FF2@xxxxxxxxxxxxxxxx
>
>
> "MrSpike" wrote:
>
> > Hi, I am trying to clean up someones's computer. I ran Ad-Aware and MS a
> > Anti-spyware and removed a bunch of stuff. I also cleaned up a lot of
stuff
> > in MSCONFIG. However, when I open MSCONFIG, I get a new item there each
> > time, just random letters followed by .exe r For example;
> > utnasmt.exe r
> > ksbzxko.exe r
> > vofffwc.exe r
>
> If you look closely, the r is probably a -r...
> >
> > I can find the files where it says they are, the System32 folder, but I
> > cannot delete them because it's says they are in use.
> >
> > The same files are not there after a restart, but there is always
another to
> > take it's place, even starting in Safe Mode. They also cannot be deleted
> > from there.
> >
> > Always in Safe Mode msconfig are;
> > autgda.exe reg_run (in the System32 folder) and
> > ntau.exe in the AllUsers Startup folder
>
> It sounds like you have been infected with the Aurora adware. Look for
> svcproc.exe in \system32 or \windows and for nail.exe in \windows. If it
is
> there, you have Aurora.
>
> It can be a pain to remove manually unless you have specialized tools and
> know how, but the scanners are getting better at dealing with it. Try
> downloading Spybot Search and Destroy and Ad-Aware, install both and
update
> while connected to the internet. Then disconnect from the internet, boot
into
> safe mode and run scans with both.
>


.