a friend with problems

No luck yet!!! I've tried everything suggested. I've used Pccillian, ad aware and AVG. It says that it's a Win32.TrojanDownloader.Agent.al and a ADW_SEARCHAID.A. I've gone into the registry and deleted what I could find by following pccillians suggestions but it still comes back. I've done all of this in reg and safe mode. The .exe files that it puts in the taskmanager change names every time I delete them. It has defeated me!. I'm gonna reinstall XP next week when i'm off for a few days. Mad The people that do this should really be brought up on criminal charges.

post a hijackthis log

look in runservices key in the registry as many of them hide there.

also look in c:\windows\system32 for weird file names. make sure you can view hidden and system files.

before you run your AV software make sure that system restore is turned off and then scan in safemode. That should do the trick.