wow i would never wish Nail.exe on my worst enemy

brinstar · Post by **brinstar** » Mon May 23, 2005 8:07 pm

i just spent 7 hours over the course of two days locked in a gritty battle with this son of a bitch. it is self-replicating, and spawns an ad client named Aurora as well as a few other shady background-type processes with suspicious names like dfjkal.exe or rruqfh.exe... nasty nasty stuff.

had to use a powerful cocktail consisting of spybot, ewido, adaware, MS antispyware, norton windoctor, and hijack this, as well as a custom-made .bat script-- in safe mode, no less-- before i could finally claim my victory

worst part is i didn't even get it from a porn site, i got it from a guitar tab site

Post by **Tossica** » Mon May 23, 2005 8:27 pm

Yeah, I fought with that one on a clients computer a couple of weeks ago. Sucks.

brinstar · Post by **brinstar** » Tue May 24, 2005 1:41 am

upon further investigation it would appear as though i used a bit too much Holy Cleansing Flame against the great satan that is nail.exe

by which i mean my windows media player is completely fucked and irreparable due to the regedit rampage i went on

ah well i was thinking it was about time for a reformat anyway

Post by **Gidan** » Tue May 24, 2005 11:47 am

We had a custoemr with this the other day. We did a reinstall to fix it. This one is a bitch.

vonkaar · Post by **vonkaar** » Tue May 24, 2005 12:10 pm

Spywarewarrior.com forums are your friends.

They are usually at the frontlines of the spy/ad/malware battle. People from Lavasoft, Spybot, Microsoft, McAffee and Symantec post there regularly.

I did a search on nail.exe and got 7500 posts. Seriously... if ya'll haven't spent much time there, check it out tonight... it's a GREAT resource.

brinstar · Post by **brinstar** » Tue May 24, 2005 4:15 pm

right that's where i got the solution after trying to kill it myself for a while

kaharthemad · Post by **kaharthemad** » Wed May 25, 2005 7:42 am

yeah i had to fix that one too. Talk about a cluster fornication. let me know if it comes back there are 3 versions. only one is removable from spywarrior.com I have the reg fix and removal instructions for the other 2.