Aurora Removal

[Martin Zugec]

2CArmon: So, did U tried what I mentioned??

1.) Use RegMon to see the process that write to HKLM\...\Run

2.) Remove files (most simple way is by using PendingFileRename)

[Carmon]

Yeh Soulin I tried it. I Worked for about 3 hrs then Aurora popped bk up again so summat on my HD Bringing it Back to life

[Martin Zugec]

Well, point 2 means not to remove, but replace... With calc.exe for example.

[Martin Zugec]

And which process was responsible for respawning Run ASEP?

[Aegis]

Checked all of the spyware lists I know of and none of them list a spyware named Aurora...

[Carmon]

So your saying its a New one?

[Aegis]

No, what I am saying is that you got the wrong name. Spyware names are not meant to be known to the end user. It was obviously a trick that every single popup would be named Aurora. Not even sure if the company who made it has a definite name, but the ones I know of are: MyPCTuneUp, DirectRevenue, ABetterInternet, and IpInSight. MyPCTuneUp actually removes the spyware that THEY made in the first place. The uninstaller included is a bit risky (made by the same company that made Aurora), but it's the only known way to remove it. Note that the uninstaller does send your computer name to their server.

uninstall.exe