Steps to take to remove the Aurora spyware (including nail.exe and svcproc.exe removal steps)

1) First off, lets do a few simple steps, press ctrl-alt-del to bring up your task list. Look for nail.exe, svcproc.exe, and really strange random looking program, like zbxhmsv.exe (it could be under a different variation of the name but you should be able to notice this easy enough). Highlight each one of these and end the task on each program you find. If you do not see all of them, thats fine, just terminate the task on the ones you see. It's possible that these may start up again, it's ok if they do as the later steps will fix this anyways.

2) If you are familiar with editing the computer registry, then do the following steps below. (If you are not familiar with editing your computer registry, then you should ignore the first 3 steps and simply use a software program as specified in "d" below).

a) In your registry, do a find on nail.exe. You will discover the following: Shell=Explorer.exe C:\windows\Nail.exe. Edit this value and remove the "C:\windows\Nail.exe" part of this. (This is causing it to run when you reboot, so we need to stop this).

b) Next go to your "run" keys under HKLM and look for a random, strange looking name like: [quutgxl] c:\windows\system32\zbxhmsv.exe Its such a random name that it will be easy to spot, remove this value. (This is causing it to run when you reboot, so we need to stop this).

c) In your registry, do a find on svcproc.exe. You will discover the following: "Unknown owner - C:\windows\svcproc.exe". You must remove this value also as this is causing it to run when you reboot.

d) These steps above should only be done if you are already familiar with the windows registry and know how to backup and edit the registry. (It is always recommended to backup your registry before editing). The simplest way to do these edits above is to use a software program to do this. Spy Guardian Pro has a good startup manager option and Hijackthis is also very popular. Many others will also work as you must remove these items from your startup or this will keep returning, along with your popup windows.

3) Now you should reboot immediately. Bookmark this page in case you need to come back. Basically what you have done above is stopped these programs from running on your computer whenever you reboot, as these are causing your popup advertisements to occur. After you reboot, you should go and delete the nail.exe, svcproc.exe, and zbxhmsv.exe programs. If you are worried about deleting these files or are uncomfortable doing so, then simply rename them to a different name (for example, rename nail.exe to nail.backup). Either way by no longer having these files, they cannot startup again on your machine as they will not exist anymore. Make sure you do not see them running in your tasklist, as they should no longer be executing. Hopefully this helped solve your popup and adware problems!