I'll start from the beginning.

Recently, I formatted my HD, because of all the accumulated rubbish and errors. I re-installed XP SP1 (I can't stand MS Updates, they mess up the system). And installed all my safe programs. I checked my system thoroughly for spyware/viruses/adware/etc and nothing was found. I installed ZoneAlarm and set it up. Then applied my Internet connection.

Everything was fine until the other day when some file downloaded itself onto the computer. WebHost. It contained 3 files. Two with no extensions called Ad (somehow it manages to allow two with the same name) and the third is an .exe called Ad.

It bugged me that ZA allowed such a program to download itself and install. Especially when I made ZA to be on highest security.

I deleted the folder and removed all trace of it (from registry and such). The problem now, is that it is consistantly appearing again. I have deleted it now (completely) four times. And everytime it appears, it loads two Pop-ups with "page cannot be displayed".

So, I would like to know, how the hell can I get rid of it, without excorising the machine.

This post has been edited by microscopic^earthling: Oct 28 2005, 04:19 AM

1. search google for a fix.
2. If google doesn't give back anything usefull check the following things:

Kill all the exes in the taskmanager.

goto START -> run -> msconfig , and click check the services and startup tabs for an entry which calls the webhost.

restart your machine, it this works you're done , if not do this:

check the registry for anything that links to thoses exes and delete them

do a windows search for the exact filesizes of the exes, they could be hiding under a different name.

check the msconfig again and reboot.

If this doesn't work, I wouldn't know either.

Hehe, get Killbox.. your problem is, as soon as you kill the process, another one spawns itself and when you delete the .exe the process rewrites itself on the disk. Use Killbox to kill it from memory and disk simultaneously - it really helped me on several such occasions. Just google for it - can be downloaded from many sites.

A search for "ad.exe" yielded mostly garbage results - but this one might give you partially related info: http://securityresponse.symantec.com/avcen...itexplorer.html

Talk about fast response. Thanks a lot. I'll do it later when I have less to do.

Right, I have tried the whole memory wipe and such and still, it re-writes itself. But this time it is slightly different. The files are now

Ad (FILE)
Ads (FILE)
WebHost-2 (EXE)
brackets equals file extension, FILE is a generic, no file type

So, what should I do, except smash my computer to pieces with a mallet?

Not a bad idea... but you could try linux .

But, have you tried an anti-spyware? Try one of these:

1. Ad-aware
2. Spybot S&D

if you have a legal version of Windows, you can also try microsoft anti-spyware from microsoft

It might even be a virus. Reboot your system in safe mode and see if it's still showing up. If it isn't, try scanning your entire system with your antivirus (assuming you have one) and the anti-spyware software.

Try this out and let us know what happens .

I've tried:
Anti-spyware (every single piece that is worth downloading)
Anti-virus (again, every single piece that is worth getting)
Killbox (it simply copied the files into its folder and left them there, didn't delete squat)
Regedit (I couldn't find the reg key for it anywhere)
CCleaner (crap cleaner, it took rubbish out, but didn't find anything to do with WebHost)
Kicking my computer when it appears.

There is something new that is happening now, it comes up with a runtime error, when I debug, it is plain HTML, in a exe file, whoever made this needs their heads checking.