net.exe & cmd.exe nightmare

Greetings, cidlockie!
  The problem is adware and spyware. First turn off Messenger Service. The Messenger service is typically not needed for home users.

Right-click My Computer and click Manage.
Fold out the Services and Applications option and click Services.
Right-click the Messenger entry, select Properties, and choose Disable under Startup Type.
Click OK.

You should no longer receive messages sent via the messenger service.

Best wishes, war1

Greetings, cidlockie!
   Check for adware and spyware

SpyBot S&D searches your harddisk for so-called spy- or adbots;
http://security.kolla.de/

or

Adaware
http://www.lavasoftusa.com/software/adaware/

Best wishes, war1

Thanks for those gents, but...

vivekpara - I tried the Housecall scanner yesterday, and it detected one minor virus which I wiped, but to no avail.

Also, thanks for the Messenger suggestion war1, but it seems that going through My Computer-Manage-Services and Apps-Services, I don't have an entry for Messenger in there to be able to disable.

I also tried running SpyBot Search and Destroy earlier, but that seems to have done nothing even though it did find a fair few things to clean. I have the Lavasoft Adaware program running fairly often as well, I've had that for a few months on this system.

I have the McAfee online scanner running right now and it has detected the following:

C:\WINDOWS\SYSTEM32\GKFM.exe    Downloader-AE
C:\WINDOWS\SYSTEM32\msapp.exe    BackDoor-ASE
C:\WINDOWS\SYSTEM32\psexec.exe    IRC/Flood.i
C:\WINDOWS\FONTS\Attributes.bat    IRC/Flood.bat
C:\WINDOWS\FONTS\Default.m6    IRC/Flood.c
C:\WINDOWS\FONTS\Design.exe    IRC/Flood.cl.hidewin
C:\WINDOWS\FONTS\GKFM.EXE    Downloader-AE
C:\WINDOWS\FONTS\Layout.exe    IRC/Flood.cd.mirc

Could any of those be the problem? Strangely, none of these were picked up by the Housecall scanner last night.

Any more ideas from anyone would be very, very gratefully received!

Thanks,
Chris.

Yeah...I'd say those are the ones.

You might be better off erasing the computer and reinstalling afterwards.  That is the best way to make sure you have no other problems...but you should be fine after the scanner completes.

Incidentally, unplugging the internet connection from the back of the PC gets rid of all the net.exe and cmd.exe instances within about ten seconds. Plugging it back in then causes them to reappear as before - whenever they feel like it.

Thanks war1, but ShootTheMessenger reliably informs me that "Messenger Service is NOT installed in this system", so I guess that can't be the problem.

I have removed all of the viruses that the McAfee scan revealed, but this has not sorted the problem out.

Is it possible to ditch the entire contents of the Windows directory and subdirectories somehow and get them back from the cd, or is that just madness?

I have no idea how I'm going to fix this and it is preventing anything at all from running, so if anyone has any other ideas.......

Thanks for your help so far though guys,
Chris.

I would backup your data.  Low-level format the hard drive and reinstall the operating system and programs and then try it.  That will be the most comprehensive solution...not to mention it should guarantee that your computer should be working.

I WOULD put virus scanning software on...like Symantec Anti-Virus...prior to restoring any data you have, though.

I suppose I'll have to try that, even though it seems an incredibly drastic solution. Perhaps I'd better try installing windows from scratch rather than choosing the upgrade option as I did when I first installed it, and when I reinstalled it last night. I'll have a bash at that first but if that has no effect I will indeed try backing everything up and formatting the hard drive.

Thanks vivekpara, if it works I'll be back offering up the points!

Cheers,
Chris.

It is a drastic solution, but its generally the only way I've found to really fix a system after damage from severe virus infection.  The other option would be to use a SafePoint from XP and go to time when your computer worked properly (like soon after you installed it).

Of course, like all Microsoft OS upgrades, a fresh install is ALWAYS the best option.  There are many registry entries that are grabbed from the previous OS that cause trouble.

I would try the SafePoint first.  (Start-Programs-Accessories-SystemTools-SystemRestore) and then see how the computer works.  If you installed any programs after that safe point, you will have to reinstall those to fix them.

If that doesn't work, do the backup, format and erase.

Best of luck with the grunt work.

Final update - eventually nothing at all worked. I did a total reinstall of Win XP and it seemed to have sorted it, and it worked for about a week, but god knows what happened then as it suddenly decided to spit untold numbers of error messages at me, saying that 'net.exe' and cmd.exe could not be accessed. I restarted the machine but that was the last I saw of it - no matter what I did it simply refused to boot up at all, to safe mode or normally, no matter what I tried.

And I'm sad to report that I bowed to the beastly virus, if that's what it was, and bought a new PC.

Thanks for your help, those who replied - all I can to anyone else who comes up against this net.exe. and cmd.exe nightmare is, well, you're screwed, basically. I hope you have better luck than I.

Cheers,
Chris.