virus, very bad

[ssahl]

Ok, my laptop has something on it that is really making me mad.
I ran a full scan on the micro trend housecall website and it says it's clean.
but I can run Ad-Aware and find some nice spyware that is normally always a dll file in the system32 folder. It gets rid of them just fine, but will always make 3 more next reboot.
I'm pretty sure this all started when I found a file called command.exe
which I could see in the add/remove programs, but when I tried to remove it, it would only pull up a website saying download this to remove command advertising software. The bigest problem I have is now I cant use my wireless, it always gives me a blue screen and says theres a driver or IRQ problem. I've ran the microtrend virus scan several times, Ad-Aware personal, hijackthis, registry cleaner, have deleted many files in safe mode, still cant use wireless. I'm pretty sure I havent got rid of the problem yet because after awhile the popups will start again. I've went through the register myself, but as I'm not the only one who uses this computer I'm not sure what should be there, and what shouldnt.

There should be a law against software like this, I mean this is bad, worst one I've ever had to deal with. I'm not sure what exactly the cause is, but it writes/creates other trojens, spyware, and I'm getting tired of this. I'm no expert, but I do know more then the average person when it comes to Windows XP and computers. If I cant get rid of this, no way your average person will be able to, command advertising software, thats kind of like the cable company bleeping in right in the middle of a football game your watching to try and sell you a big mac. has anyone else had this problem, and please tell me I can get rid of it without having to reformat. If this is against the law, and more information is needed to report these jerks just let me know because nothing would make me happier then to get these guys. I'm getting real tired of popups that say my computer is infected, yea it is, by you.:rolleyes:

[rckershaw]

when you went into safe mode did you turn off system restore? I wonder if you have a hidden file on your computer if you think you do download Blacklit . www.f-secure.com/blacklight it's beta but if you have a hidden file it will find it.

[pam123]

Okay, first go off to the FTC and file a complaint against these folks, what they've done is criminal and I mean letter of the law criminal.
FTC complaint form is here : https://rn.ftc.gov/pls/dod/wsolcq$.startup?Z_ORG_CODE=PU01
Now, you've heard the term "extortionware"?
That's what you've got, they want to make you pay them to make this go away.
Don't do it. You'd have to be some kind of loon to give these people a credit card number or your PayPal account number.
I woud try Move on boot : http://www.softwarepatch.com/software/moveonboot.html
or Wholockme : http://www.dr-hoiby.com/WhoLockMe/index.php
If either of those works you'll have to repair the wireless connection : http://www.snapfiles.com/get/winsockxpfix.html
If this doesn't work there's always a repair install of XP.
And finally, last but not least, I'm paranoid so I'd just bite the bullet do the backups and nuke and pave.

[glc]

Try the online Ewido scan. Command.exe appears to be a variation of the AOL password stealing Trojan.

http://www.ewido.net/en/onlinescan/

[ssahl]

Ok, that helped.
My problem was that it wasnt letting me delete anything in my local settings/temp internet files folder. Even though when I tried to run the ewido scan it told me what files were 'bad' but it would just shut IE down when I tried to fix them. I was able to boot from ERD boot disk and delete them from there. I still have a registry entry that I cant delete from 'PCGUARD' but I dont think thats a bad one. At least now I can use my wireless connection without getting a blue screen.
I did infact report them to the FTC, thanks for the URL pam
I think all I have left to do is uninstall firefox and I should be ok, cross my fingers.
thanks for the help, you guys are the best.