I have Windows XP and a few days ago I was surfing the internet and BAM a pop-up comes up. My Avast Antivirus starts going nuts, and my computer has been wacked out since then. I will list my problems and hopefully the computer techs here can help.

1. CPU usage at 100%. I have four or five svchost*****'s running. I also had an uppercase SVCHOST***** in system32 that I was able to delete, but I'm not sure why the others keep running. I also have a SECURITY***** that I am having a hard time with. I'm sure this is illicit just like the SVCHOST***** file.

2. I keep getting pop-ups and cannot get rid of them. I've run my antivirus on reboot and it finds nothing. The pop-ups run from a program called "Aurora" that is found in system32. I delete it but the pop-ups keep appearing. I assume this is related to my bigger problem. Ad-Aware detects nothing out of the ordinary.

3. My browser starts up at http://ipassist.biz/index.php?id=186 every time, no matter what I set the home page to. This is probably interlinked with the advertising. Once again, Ad-Aware detects no spyware!?

4. Also related to the advertising, certain words like "you" and "help" are hilighted on all pages I visit. This is probably yet again the same combination of spyware/viruses.

Thanks alot for your help in advance guys. I'm pulling my hair out over this!

 

Sounds like your browser was hijacked along with a deposited malware or trojan causing the popups.

Make sure ALL of your anti spyware is updated and run them.

Go here "Security Help Tools" from "Tech Support Guy". Download "Hijack This Log" from the list. Do "a system scan and save a log file". Then post the results in their "Security" forum. The people there are very quick with helping you out.

I just came from those forums and see others were hit by this same "Aurora" popup problem.

Perhaps this post might help. Scroll down to "The Egg's" answer where you can get an "Aurora uninstaller".

Here is a longer subject thread on this very same subject.

 

Here is a list of other posts from their "Search", I made, on this problem.

By the way, someone else had this very same "ipassist.biz" hijack problem and it was answered/solved here

Good luck

 

Goto Mcaffee and down load their free STINGER program, this will remove most viruses and trojans.
http://vil.nai.com/vil/stinger/
also goto Microsoft and download their beta version of antispyware.
http://www.microsoft.com/athome/secu...e/default.mspx

 

You can try Highjack This for starters..

Get the free Spyware Blaster and run it as well..

Get the free Google toolbar and install it.. (this will prevent future popups)

This should get you back up and running.....I like the Microsoft antispyware as well (it's free for now too) the problem is it runs out in June, so I probably wouldn't bother with it..

Probably time to look at a host file manager as well (this will prevent your browser from connecting to sites that are on a black list.
You can get a host file and install it manually here

 

Have you heard of Microsoft anti-spy ware yet? It is in Beta Version 1 right now and personally even though it is from Microsoft it is really good. I do mean really good. It is good for the home user, not big networks or corporations though. Download that and I guarantee that will help you out.

http://www.microsoft.com/athome/secu...e/default.mspx
http://www.liutilities.com/products/...brary/svchost/

SVCHOST***** is an operating system process, it isn't anything bad.
Now for the security***** that could be a problem there.

I would make sure your anti-virus is up to date then disconnect your internet connection. Then try to clean your machine out. A lot of times when you delete these programs they make other scripts which go out to the internet and re-download them again. So if you disconnect from the internet you shouldn't have anything to worry about while you are cleaning the pc out.

Let us know how it goes.

 

I can vouch for the Microsoft program myself. It works for me plus it will alert you if some program trys to hijack your home page on your browser and when it updates itself.

 

yes i can vouch for it as well, that's why i posted it.

 

Hey marshall,
Another thing to think about would be the restore option in XP.

Start | Programs | Accessories | System Tools | System Restore
Find a checkpoint in bold blue that is not that old (yesterday, day before, etc) and select that

After you restore, then do as others have said on here. If your system is that messed up right now, downloading any of the items above may not resolve.

Just an idea for ya

 

I like cruising Majorgeeks.com, check that site out. I would look in the Viruses, adware and spyware specific forums.. find the sticky on how to remove viruses, and spyware.

Thx Bvcannon and others for recommending Microsofts program. I just found out that my adaware wasn't stopping the VX2 malware, I had the tool to detect it, but adaware couldn't find it. Apparently Microsoft found it and removed it for me.

 

I also read where the new Microsoft anti spyware will find some malware that Ad Aware and Spybot S&D didnt. In all, just have to keep your security up.

 

You've got a few trojans taking over your computer.. fun stuff. Download Microsoft's Beta anti-spyware.. then update Norton if you have it, if you don't PM or Email me and I can send you that with up to date virus definitions. Then get Ad-Aware SE, then spybot and you shouldn't have anything bad left on your computer. Also ditch IE and go with Mozilla.. very little pop-ups and they're not as vunerable as IE.

If anybody needs some antivirus goodies email me and I'll send you the programs.

 

The SVCHOST file was probably SCVHOST*****, unlike Linux, Windows doesn't allow multiple files of the same name, regardless of different case. SCVHOST***** is a trojan of some sort.

When it comes to browser hijackers, I have found Spybot S&D to work very well.

 

SCVHOST***** can run many times concorently....
You can read about it here

http://support.microsoft.com/?kbid=314056

My system is clean of any Viruses or Trojans and I'm running 6 instances as we speak....

 

SCVHOST***** -- TROJAN!
SVCHOST***** -- Microsoft operating system file

Don't get the "V" and "C" confused. If you do have SCVHOST***** as a running process then you have a Trojan (back end application that allows remote computers to ping and connect to yours) as furball69 said.

I too have 6 instances of SVCHOST***** - This isn't a problem.

Even though we all know how Microsoft can be sometimes, I can see light down the tunnel for them in general. Look at this anti spy ware program. It is great, one of the best things they have done in a long time and this is just BETA 1. The new version comes out July 31. They are really trying hard for users.

Another thing that is so simple that most computer users over look are their temporary internet files storage. There is a setting in Internet options that allows you to put a cap on the size of this folder. I highly recommend putting this at 1MB. So simple yet so effective.