At the root of this problem is a little executable they've stuck in your windows directory called "nail.exe" along with a couple of other little bits of nastiness. You can't just locate it and delete it. It respawns under different names, and redownloads the malware.
There is an uninstaller for nail.exe (the aurora hijacker) but... and it's a big but... it is offered by the same outfit that wrote the malmare in the first place: Direct Revenue, LLC.
I was unsure of it, and tried lots of other fixes first, but out of desperation I did finally decide to give it a try, and it did appear to work, and it didn't appear to do anything else. But nobody trusts them, and rightfully so. If you google on "aurora" or "nail.exe" you see dozens of help sites about this thing. Much of the language is [ahem] colorful. I tried lots of other methods that I found posted on lots of various tech help sites... with no joy.
The uninstaller is here:
http://www.mypctuneup.com/evaluate.php?b=aurora
I felt a little uncomfortable recommending it, but I don't know of anything else that works. An uninstaller that ~requires~ you to be connected to the internet to run, and politely asks you to disable your firewall and antivirus-- this just *screams* suspicions.
I ran it with my firewall up and with my antivirus running, and it worked just fine and nothing appears to have been left behind.
It's been several days now, and I'm now pretty confident that the uninstaller did work as promised, and I haven't seen any evidence that anything untoward was done in the background.
Regards,
Just wanted to let everyone know. I had a user with this same problem. ( winfixer 2005 ). I searched the registry for the following: atea, winfixer & uwfx5. Deleted all instances of these key's, as well as deleted the cookie & the shortcut on the desktop & it's no longer coming up. Prior to this I also installed a trial version of McAfee Spyware Blocker which didn't fix the issue on it's own, but found the files.