I was using AdAware, WinClean, AVG and Stinger to clean unwanted items from my computer, which worked pretty good. Then I purchasee Xoftspy for $40.00 and it works better than the other four combined and my computer runs much faster. However I still must run the program once or twice daily to clean off Aurora and other trojans, and malicious software. What do I need to do using the Xoftspy software to keep these programs from re-installing on my computer? Short of going to Direct Revenue LLC
107 Grand Street, 3rd Floor, New York, NY 10013. V: 646.613.0376 F: 646.613.0386
http://www.direct-revenue.com/contacts.php and beating the crap out of somebody.

Hi harco and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

1. If you haven't logged in go to Geeks to Go and do so. Then proceed to item a.

If you already have logged in, go directly to item a.

1. Click on My Controls at the top right hand corner of the window.
   
2. In the left hand column, click "View Topics"
   
3. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"

3. Please DELETE your current HJT program from its present location.

4. Download and run the following HijackThis autoinstall program from Here HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

1. Run HijackThis
   
2. Click SCAN and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to'select all', Ctrl-C to 'copy')
   
3. POST the log into this thread using 'Add Reply' (Ctrl-V to 'paste')

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER


Regards,

Trevuren

Hello Trevuren,

Notepad will not open on my computer, it says it is not a user program so apparently I have other issues. The notepad icon isn't even a notepad it looks like a blue screen with 3 buttons. Maybe a letter from my attorney to Direct Revenue will have an affect, my email to them was ignored. Maybe we should have everyone in the U.S. complete the contact form at their website.

Thanks for the effort.
Harco

Try this:

Right click on http://www.greyknight17.com/spy/RepairDesktop.reg and download that file. Double click on it and click on Yes when it asks you if you want to merge it into the registry. Once that's done, restart your computer.

Login as usual and now right click on your Desktop and go to Properties. Next go to Desktop tab->Customize Desktop button->Web tab. Uncheck everything listed there. Then delete all the entries listed except for 'My Current Home Page'. Click OK and OK.

Regards,

Trevuren

Hello Trevuren,

When I right click on the link http://www.greyknight17.com/spy/RepairDesktop.reg this is what I get:

REGEDIT4

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Desktop]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]

[HKEY_CURRENT_USER\Control Panel\Desktop]
"Wallpaper"=""
"OriginalWallpaper"=""
"ConvertedWallpaper"="C:\\WINDOWS\\Web\\Wallpaper\\Windows XP.jpg"
"ConvertedWallpaper Last WriteTime"=hex:00,60,6b,4e,dd,27,c1,01

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ClassicShell"=-
"ForceActiveDesktopOn"=-
"NoActiveDesktop"=dword:00000001
"NoViewContextMenu"=-
"NoActiveDesktopChanges"=-
"NoActiveDesktop"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General]
"BackupWallpaper"=""
"WallpaperFileTime"=hex:00,00,00,00,00,00,00,00
"WallpaperLocalFileTime"=hex:00,f8,29,17,d6,ff,ff,ff
"TileWallpaper"="0"
"Wallpaper"=""
"ComponentsPositioned"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\User Shell Folders]
"Desktop"=hex(2):25,55,53,45,52,50,52,4f,46,49,4c,45,25,5c, 44,65,73,6b,74,6f,\
70,00
"Custom Desktop"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoViewContextMenu"=-


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop"=""

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Desktop"=hex(2):25,55,53,45,52,50,52,4f,46,49,4c,45,25,5c, 44,65,73,6b,74,6f,\
70,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop"="C:\\Documents and Settings\\All Users\\Desktop"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Common Desktop"=hex(2):25,41,4c,4c,55,53,45,52,53,50,52,4f,46,49, 4c,45,25,5c,\
44,65,73,6b,74,6f,70,00

It's not a download. While I'm pasting and copying this to you, aurora has popped up twice. I HATE THIS FREAKIN COMPANY. I think we should start an email campaign to the advertisers using Direct Revenue stating that we are going to start a National Boycott of there products until they stop using this malicious approach to advertising.

Thanks for trying,

Harco

Let's see if we can clean up Aurora/Nail

BEFORE BEGINNING, Please read completely through the instructions below and download the files from the links provided. You may want to save or print out these instructions for easier reference.

1. Download Ewido Security Suite.

2. Download Lavasoft's Ad-Aware and the VX2 Cleaner Plug-in.

• Install Ad-Aware using the default options.
• Then install vx2cleaner_inst.exe, using all the defaults there as well.

3. Run Ad-Aware

• Update to the latest definitions
• Then click on Add-ons in the lefthand column.
• Select VX2 Cleaner V2.0 and click Run Tool. Click "OK".
• If something is found, click "Clean" as in the directions given.
• Click "Close", and EXIT Ad-Aware.

4. Reboot your PC and run Ad-Aware again.

• This time, click on the Start button in Ad-Aware
• Select "Perform smart system scan" and click Next.
• Once the scan finishes, click "Next" again.
• Select all objects found ("right click anywhere in the list of found objects and click "Select All Objects").
• Click "Next" one more time, then "OK" to confirm the removal.
• You will be prompted to set Ad-Aware to run on reboot, click "OK".
• Exit [B]Ad-Aware[/B]
• REBOOT your PC
• When Ad-Aware starts up, click on "Start", then "Next".
• Follow the steps above if anything is found, or click "Finish", then EXIT Ad-Aware.

5. For a final cleanup, please install and run Ewido.

1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
2. When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
3. From the main ewido screen, click on update in the left menu, then click the Start update button.
4. After the update finishes (the status bar at the bottom will display "Update successful")
5. Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
6. If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.
7. When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

6. Please finish up by rebooting your system once more, and posting a new HijackThis log and the log from the Ewido scan.

Regards,

Trevuren

Hello Trevurena,

Thanks for the reply.

Maybe I'm not making my self clear. The Xoftspy software works perfectly at removing Aurora and all of the binary data associated with Direct Revenue. Somehow Aurora has the ability to bypass the popup blockers I am using through Mozilla Firefox as well as the popup blockers form Earthlink.

When I run Xoftspy Software it list all of the file extensions associated with Aurora, usually there are 20-30. It them removes and qurantines those files, sometimes a window will pop saying 1 or 2 of the files would not delete, and ask if I want to reboot. When I reboot another window pops up and says those files have been removed. When I check the registry editor all of the Aurora files are gone. I think the problem I have with DSL is that it is always on and Aurora is searching out my computer when I'm offline.

I am going to start a record of all the adertisers using Aurora and Direct Revenue advertising and begin a personal campaign to boycott the products sold by those companies. The last thing an advertiser wants is bad publicity, and the only way Direct Revenue will change is to hit their pocketbook.

Thanks again,
Harco

P.S. I was running AdAware and it was working, after I installed Xoftspy, I ran AdAware and then ran Xoftspy immediately after and it picked up on several files AdAware missed.

Did you perform the Fix I requested as I requested? If you did, you wouldn't be getting anymore Aurora popups at all.

Trevuren

I did a removal in the Control Panel of programs I didn't reckognize. Apparently I or someone in my home had downloaded some kind of free program which installed advertising software I was unaware of.

Thanks for all your help, no more popups. I just ran Xoftspy and found a new Trojan, it works great.

Harco

Please respond to my question posed in Post #8 and post a fresh HJT log so I can close the topic.

Trevuren

After I found the software in the Add Remove section of the Control Panel there was no need to download Ewido, Lavasoft, or VX2. I have not had any more issues with Direct Revenue, Aurora or ABI Networks, and no more popups. The reason it continued to reappear in my registry editor was because I had that software.

Please close the topic.

Thanks again for all the great help, have a great labor day.

Harco

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.