Problem with adware

By succotashi
May 15, 2005
Topic Status:
Not open for further replies.
  1. hi, I am having a very difficult time removing some adware on my computer. I am running Windows XP, and I get popups from "Aurora", a popup that asks to install some "MM viewer from nLite", and other various ad popups. I have tried running adaware se and spybot as well, but neither has solved the problem. I downloaded HijackThis and attached the log file. Please help me eliminate this adware problem. Thank you.

    Attached Files:

  2. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    Hello and welcome to Techspot.

    Go HERE and follow the instructions carefully, especially about updating and HJT placement. Print the instructions out if you can.

    Once you have done that, post a new HJT log.


    Regards Howard :wave: :wave:
  3. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    Boot in Safe Mode.
    Switch System restore OFF.
    Press Ctrl/Alt/Del simultaneously, select Taskmanager/Processes, select the process (if there), click "End Process" for:

    cirvboq.exe

    Next, click Start/Run and type services.msc and click OK. Look for the service:
    svcproc.exe
    Doubleclick it, click Stop if it's running, and change the Startup type to Disabled.

    Next, run a HJT scan and place a tick-mark in the little square before (if still there):
    c:\windows\system32\cirvboq.exe
    O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
    O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
    O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
    O4 - HKLM\..\Run: [hyqvwt] c:\windows\system32\cirvboq.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
    O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
    O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0008.exe
    O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

    Now click on the Fix Checked button in HJT.
    When done, delete the highlighted bold files.
    Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
    Repeat this for ALL [usernames].
    Boot normal. When all OK, switch System Restore back on.

    PS: you may have to reboot after stopping svcproc.exe before you can delete it
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.