325is.....Here's what some research has turned up .......
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\errlkqb.exe (file missing)
These must be removed.....and I think you have removed them before , however they seem to be coming back as the result of the "Nail.exe"
Nail .exe is a trojan ..... this is what it's about .......
Got Aurora? Nail.exe?
Here is who you can thank for your misery:
http://www.direct-revenue.com/news6.phpDirect Revenue Launches Aurora
New Ad Client Affords Greater Brand Visibility, More Efficient Distribution
New York, New York – April 26, 2005 – Direct Revenue today announced the launch of its newest ad client, Aurora™.
The Aurora ad client is designed to improve product visibility and consumer services. The roll out of the upgrade to the DR behavioral network began on April 5th by replacing outdated ad clients in an effort to improve consumer awareness. Like other DR ad client brands such as “SolidPeer”, released in September ‘04 and “Ceres” released in November ‘05, the Aurora Ad Client is compliant with the branding and removal standards of all major proposed Federal legislation relating to online contextual ads such as HR 2929.
it has installed a reg entry in to softwaremicrosoftwindows ntcurrentversionwinlogon “Shell” and
Shell=Explorer.exe C:WINDOWSNail.exe
it also keeps creating files in windowsprefetch with a random serise of letters and the same random serise also appears in the system process’ an example being
xgoudno.exe which i then end so i can try to delete the prefetch file but then renames its self to something like ahilwj.exe
if running outside of safe mode it also installs a programme called aurora.exe which then produces the pop ups out of the normal browser window. I am running “hijackthis” “norton AV 2005” “adaware personal SE” and none of these seem able to deal with the threat effeciently.
This indeed a real nasty ......... however , I also found this which may do the job .......
Do not, UNDER ANY CIRCUMSTANCES, use mypctuneup.com. It is owned by Direct Revenue LCC, the same company that produces Aurora.
In an article by a LEGITIMATE anti-spyware company, it is stated, "None of the installed programs [of Direct Revenue, including Aurora and mypctuneup] have information that identifies them as a product of Direct Revenue, nor do the programs have the brand name of Ceres or Aurora clearly identified in the executable files. One of its running programs uses a randomly generated file name [your gmbgklixrp, tash] so it is impossible to tell what the file does. The others are named in vague or deceptive ways such as "System Startup Service" or "Nail.exe". (
http://www.pcpitstop.com/news/drnotice.asp)
Mypctuneup will remove nail.exe, but will make many more problems for your computer. In the licensing agreement before installing mypctuneup, you allow the installation of a web bug. Also, you consent for your "non-personal information", including IP address, ISP, domain, to be recorded.
The legitimate, well reviewed (by cnet and pcmagazine) program Webroot Spy Sweeper can be used to quarantine and nullify the effects of Aurora (use the 30 day trial).
Webroot Spy Sweeper 14 day free trial .......
http://www.download.com/3000-8022_4-10192729.htmlI have D/l and tested Spysweeper and it is fully functional and may just do the trick .......
Please let us know how it goes as this nasty has infected 1000s of machines .
dl65
