Annoying bug/virus I can't get rid of

[Mindy]

This all started when a friend of mine used my computer on May 26th. She went to a site called laugh2day.com and all these popups bombarded my screen. So I'm trying to close them and it slows my computer down to like a standstill and then freezes it. I had to AltCtrlDel all of the windows not responding. I did a Spybot search and destroy after I rebooted and got rid of all the bad stuff it had put on my computer, or so I thought. But when I rebooted popups appeared as soon as I got in windows, so I did another Spybot and there were more bad programs, and some of the same ones that it's supposed to block back on there, so I got rid of them again, and this time when I did another search it said they were gone. A couple days later I was playing AC and experiencing horrible lag for no reason. Buli had absolutely none at all. I go into my contol panel for something and it takes 3 minutes to load. I knew something was screwy (and those popups were back when I started up my computer) I called up my dad and he came over. Ever since then he's been trying to get rid of this crap. He goes into the registry and deletes all the associated files and whatnot but it keeps coming back. Here are some of the bad files:
WinWildApp.exe
w8.exe
zxr.exe
~DF8027.exe (can't delete because it's being used)
When they come back it's usually in the temp folder or in prefetch.

I'm not exactly sure what this is, but I know that when I get rid of the bad files, they always pop back up soon after. I figure that the file responsible is hiding somewhere on my HD. This is one annoying and malicious bug. I'm not entirely sure what it's doing to my computer, but here is one thing:

A couple days ago I was trying to burn some songs onto my HD from CDs, and I wanted to listen to them first. Usually when I put a CD into my drive Windows Media Player pops up. Well, all of a sudden it didn't do that. I click on the icon and it doesn't open. I really wanted to listen to this new CD so I open the CD player in the entertainment folder. I put the CD in and it says new artist, but then I push play and it says there's no CD loaded. I know it's nothing to do with the CD drive itself because I can still use it to play games and whatnot. So I look at the icon on my desktop for WMP and it's not the right one. I look at the properties in Explorer and it's significantly smaller than the one on Tyler's computer. The setup file is also smaller. So I DL the critical updates from WindowsUpdate figuring it should fix the problem and override the bad one. Nope, doesn't work. I finally got it working by copying Buli's file and it overrode it. Also, before I got this fixed I looked at the modification date for WMP was May 26th, the same day she accessed that site. I reinstalled ZoneAlarm and the zxr and w8 file asked permission to access the internet. I said no of course...tracking cookies? Arg, I'm so aggrivated.

I have been looking on the internet for info about those files, and have found nothing but bad.
I really have no idea what to do, except I guess wipe out my whole hard drive and start over. Neither my dad or myself have the expertise to do so.
I know I've left out info and I'm not sure if this even makes any sense at all. Just my ranting.

I'm kind of hoping one of you guys has heard of this or knows what to do. I'm so tired of deleting these files. Sorry for the long read Any help will be much appreciated.

[Ehran]

Well, I'm going to assume you are running WinXP, since you haven't specified. My first suggestion would be to run your system in safe mode, and attempt to isolate the problem files.

Presumably, if you are getting these pop up programs installed every time you re-boot, there is a virus or other hostile program doing the actuall installation. By restarting the computer in Safe Mode, you should be able to keep the program from automatically running, and thereby giving you a chance to delete it.

To enter Safe Mode, go to your start menu, click on 'Run', then type 'msconfig'. That will open a nice little confusing menu for you. Select 'diagnostic startup' from the list in front of you. That will tell the computer to restart in safe mode next time.

While you are in this config menu, go to the tab labeled 'startup'. Here you'll have listed the programs that are set to automatically start when windows loads. You can deselect them to prevent them from loading up. If you are having trouble isolating the pop up program, this might be one way to do it. I'll do some web searches myself, but this should help you out a bit. Just be careful to write down the error messages you get, and make sure you are cautious when deleting files.

Let me know if this helps, if not - I'll see what else I can figure out.

-Alex

[Mindy]

I have gone into safe mode many times and emptied the registry of all the files containing those names. I've managed to get rid of the popups somehow, and this was before the issue with media player. I think that is when I was loading the control panel.

I believe Zone Alarm has prevented any new bad files from getting in through the net, but that doesn't help with the ones that snuck in before.

Also, I did a virus scan at housecall.antivirus.com and it found one infected file. It said it was noncleanable, so I had it deleted since I didn't recognize it to be anything of importance. This was yesterday I believe.

[Skaven]

Safe mode isn't the only way, you can also use your windows CD to boot from (better than safe as it only uses the windows root stuff) and then you can access your drive (back to DOS type functions here) and hard delete the files. Also, when you are deleting things make sure you turn "Image Saving" off, therefore it will not remember what you did, and possibly undo it... Once that is done you can reboot, relete the bad files, empty the recycle bin (unless you do that the files aren't gone) and then reboot again. If it works correctly, you can turn image back on (makes windows boot about a Billion times faster because it can load things that you use and personalized again). I just went through this with my laptop, and I hate to say it, but I moved all the files my dad and I used (he's the primary user of the machine) to my desktop, then formatted the drive. THAT got rid of the pesky virus...

Hope that helps, or at least makes you feel less alone in these things.

Nate

[Ehran]

Urk...sorry hon. I'll see if I can dig some more stuff up - a friend of mine, known to you folks a Kuroi, might have an idea of what to do. I'll see if I can run it past him.

[Citizen]

Sounds similar to what a friend of mine had. If it is, it's called a "Dialer" and is a nightmare to get rid of. It took Malzeroth several hours to completely rid the system of the problem. An alternative that might work is downloading Mozilla and using it as your internet browser instead of IE. Here is the site:

www.mozilla.org/products/firefox/

Of course, the only sure way to completely rid yourself of it is to wipe the drive and reinstall

[Ehran]

Mozilla is good, I installed it on a friend's computer when he was have connection trouble with Internet Explorer and he swears by it now (incidentally, he now swears AT Microsoft much less often as well).

[Mindy]

Thanks for the advice guys. I'll run all this by my dad first, since he is my computer wizard and knows what he's doing, atleast more so that I

[Taco]

Hiya Mindy, All I had to read was the first part of your post and knew what your problem was, its not spyware thats causing your problem with them popups, its Ad-ware. They are 2 different things but both can be bad for your computer, the thing about ad-ware is it installs crap on your computer without you never knowing about it. I just had the same problem I turned my computer on and get bombed with popups. This is what I did I installed Ad-aware 6.0 which can be found at www.lavasoft.de/ .....Also get yourself a good popups blocker, I use MSN Tool Bar, Yahoo has a good one too.

[Skaven]

I use the Google toolbar, and it blocks EVERYTHING. I have to turn it off (an easy click of the mouse) to get some pop-ups that I want to go off... (webmail proggies et al.)

[weird guy who lost his pass]

If windows won't let you delete something you want gone for one reason or another, change the extension, then you should be able to delete it. Sometimes you may have to reboot after you change the extension.

Adware/spyware is notorious for giving you that " Access denied, this file is in use by another person or program"
error when you try to delete it.

just change the extension from .exe to .ex or .asd or whatever, just *don't* change it to a valid filename.

Be d**n sure it's something you *should* be deleting though.

Another thing, the reg is very dangerous place. Be very carefull when messing around in there, delete one wrong file and you could be re-installing windows.

I have been using ad-aware from lavasoft for years, it works really good... www.lavasoft.com

[Mindy]

Awesome, thanks for all the info guys.

One thing I just did was go through all the files and removed each one that was modified on that date. Don't worry, I still have them in case something goes wrong. Everything seems to be doing okay so far though. I found that a lot of those files were hiding in the spybot folder and in my documents and settings folder.