Problem with adware

By succotashi
May 15, 2005
  1. hi, I am having a very difficult time removing some adware on my computer. I am running Windows XP, and I get popups from "Aurora", a popup that asks to install some "MM viewer from nLite", and other various ad popups. I have tried running adaware se and spybot as well, but neither has solved the problem. I downloaded HijackThis and attached the log file. Please help me eliminate this adware problem. Thank you.

    Attached Files:

  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Go HERE and follow the instructions carefully, especially about updating and HJT placement. Print the instructions out if you can.

    Once you have done that, post a new HJT log.

    Regards Howard :wave: :wave:
  3. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    Boot in Safe Mode.
    Switch System restore OFF.
    Press Ctrl/Alt/Del simultaneously, select Taskmanager/Processes, select the process (if there), click "End Process" for:


    Next, click Start/Run and type services.msc and click OK. Look for the service:
    Doubleclick it, click Stop if it's running, and change the Startup type to Disabled.

    Next, run a HJT scan and place a tick-mark in the little square before (if still there):
    O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
    O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
    O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
    O4 - HKLM\..\Run: [hyqvwt] c:\windows\system32\cirvboq.exe
    O15 - Trusted Zone: (HKLM)
    O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} -
    O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

    Now click on the Fix Checked button in HJT.
    When done, delete the highlighted bold files.
    Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
    Repeat this for ALL [usernames].
    Boot normal. When all OK, switch System Restore back on.

    PS: you may have to reboot after stopping svcproc.exe before you can delete it
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...