Adware Alert – NAIL.EXE

Nail.exe and aurora.exe install with a variant of a spyware program called "Transponder". It hijacks your browser's home and search pages to its controlling server. It tracks the URLs that you visit and the data you enter into web based forms. This variant establishes an SSL (secure socket layer) connection to the controlling server at vx2.cc, abetterinternet.com or msview.cc. From there it sends your personal information and can also download updates without your knowledge. It also generates popup ads. Some sources categorize nail.exe as belonging to Trojan.Win32.Stervis.b.

We'd recommend removing these files using WinPatrol. First, go to your Active Tasks and kill any of these files that appear there: farmmext.exe, belt.exe, susp.exe, satmat.exe, alchem.exe, conscorr.exe, nail.exe, bolger.dll, svcproc.exe, iehelper.dll, vx2.dll, tps108.dll, sitehlpr.dll, msview.dll, twaintec.dll, host.dll, bi.dll, mxtarget.dll, multimpp.dll, localnrd.dll, voiceip.dll, zserv.dll, btgrab.dll, ceres.dll, and speer.dll. Don't worry of all of these aren't found on your system. They install with different variants. Finally, go to your Startup Programs and remove the .exe files then go to your IE Helpers and remove the .dll files found there. If running WinPatrol 8.x or later, right click each file then select "Delete file on reboot" then reboot your system.

Additional background information and manual removal instructions at http://www.doxdesk.com/parasite/Transponder.html.

Spyware

Remove