Morning all,

I was removing some spyware from my mates Dad pc last night.
I ran the usual tools, AAW6, Microsoft Anti spyware etc. Ran them in Safemode etc.

I came across a couple of bits of spyware I couldn't get. None of the antispyware flagged them up. I only caught them because either the pop ups continued or Zonealarm caught the process trying to get out.

One of them was Aurora, a pop up program the others I don't know what they were I only got the process name from ZA. The process names seemed to be [random string of characters].exe

I followed intructions similar to this

Eliminate the Aurora pop-up spyware:

1. Go to start/run and type CMD press ok
2. When it opens type CD and press return and then when you see the C: prompt type CD/WINDOWS press return
3. Type NAIL.EXE /FullRemove press return


Note: Make sure that there is a space between NAIL.EXE and the /

Go to TechGuy for a full explanation of the situation - only needed if you want additional information about the Aurora problem.
Upon further research Aurora comes from. Direct Revenue LLC. AKA Offeroptimizer and Abetterinternet.com.
This seemed to get rid of aurora but I'm not confident. The others I blocked and left just because I wanted to go home. The crap has screwed up IE quite badly and XP is a little unstable now but Firefox works ok.

Any idea if this was the right way to shift Aurora and any idea how to get rid of the others?
I don't have access to the machine right now so I can't post a Hijackthis log.

If the machine is still screwing around I'm going to reformat it but I was wondering how best to tackle these for future reference.