Page 1 of 1
wow i would never wish Nail.exe on my worst enemy
Posted: Mon May 23, 2005 8:07 pm
by brinstar
i just spent 7 hours over the course of two days locked in a gritty battle with this son of a bitch. it is self-replicating, and spawns an ad client named Aurora as well as a few other shady background-type processes with suspicious names like dfjkal.exe or rruqfh.exe... nasty nasty stuff.
had to use a powerful cocktail consisting of spybot, ewido, adaware, MS antispyware, norton windoctor, and hijack this, as well as a custom-made .bat script-- in safe mode, no less-- before i could finally claim my victory
worst part is i didn't even get it from a porn site, i got it from a guitar tab site
Posted: Mon May 23, 2005 8:27 pm
by Tossica
Yeah, I fought with that one on a clients computer a couple of weeks ago. Sucks.
Posted: Tue May 24, 2005 1:41 am
by brinstar
upon further investigation it would appear as though i used a bit too much Holy Cleansing Flame against the great satan that is nail.exe
by which i mean my windows media player is completely fucked and irreparable due to the regedit rampage i went on
ah well i was thinking it was about time for a reformat anyway
Posted: Tue May 24, 2005 11:47 am
by Gidan
We had a custoemr with this the other day. We did a reinstall to fix it. This one is a bitch.
Posted: Tue May 24, 2005 12:10 pm
by vonkaar
Spywarewarrior.com forums are your friends.
They are usually at the frontlines of the spy/ad/malware battle. People from Lavasoft, Spybot, Microsoft, McAffee and Symantec post there regularly.
I did a search on nail.exe and got 7500 posts. Seriously... if ya'll haven't spent much time there, check it out tonight... it's a GREAT resource.
Posted: Tue May 24, 2005 4:15 pm
by brinstar
right that's where i got the solution after trying to kill it myself for a while
Posted: Wed May 25, 2005 7:42 am
by kaharthemad
yeah i had to fix that one too. Talk about a cluster fornication. let me know if it comes back there are 3 versions. only one is removable from spywarrior.com I have the reg fix and removal instructions for the other 2.