SpyBot..finds stuff Ad-aware misses...
http://www.safer-networking.org/en/download/
I had that problem too. I had to get on the phone to Symantic to get rid of it, and even after that, I found another part or two of it. Good luck. (I really hate those people!)
Is this the crap you were cussin' at the other day?
http://www.mcse.ms/message1765635.html
Also, a lot of forums suggest "Hijack This"
At the root of this problem is a little executable they've stuck in your windows directory called "nail.exe" along with a couple of other little bits of nastiness. You can't just locate it and delete it. It respawns under different names, and redownloads the malware.
There is an uninstaller for nail.exe (the aurora hijacker) but... and it's a big but... it is offered by the same outfit that wrote the malmare in the first place: Direct Revenue, LLC.
I was unsure of it, and tried lots of other fixes first, but out of desperation I did finally decide to give it a try, and it did appear to work, and it didn't appear to do anything else. But nobody trusts them, and rightfully so. If you google on "aurora" or "nail.exe" you see dozens of help sites about this thing. Much of the language is [ahem] colorful. I tried lots of other methods that I found posted on lots of various tech help sites... with no joy.
The uninstaller is here:
http://www.mypctuneup.com/evaluate.php?b=aurora
I felt a little uncomfortable recommending it, but I don't know of anything else that works. An uninstaller that ~requires~ you to be connected to the internet to run, and politely asks you to disable your firewall and antivirus-- this just *screams* suspicions.
I ran it with my firewall up and with my antivirus running, and it worked just fine and nothing appears to have been left behind.
It's been several days now, and I'm now pretty confident that the uninstaller did work as promised, and I haven't seen any evidence that anything untoward was done in the background.
Regards,