# Help with W32.Spybot.Worm

**URL:** <https://boards.straightdope.com/t/help-with-w32-spybot-worm/261767>\
**Category:** Factual Questions\
**Created:** [August 27, 2004, 10:03am UTC](https://boards.straightdope.com/t/help-with-w32-spybot-worm/261767 "2004-08-27T10:03:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mr.Svinlesha](https://avatars.discourse-cdn.com/v4/letter/m/22d042/32.png) [@Mr.Svinlesha](https://boards.straightdope.com/u/Mr.Svinlesha)\
**Post date:** [August 27, 2004, 10:03am UTC](https://boards.straightdope.com/t/help-with-w32-spybot-worm/261767/1 "2004-08-27T10:03:57Z")

</div>

I’ve just purchased a new computer and within two days managed to infect it with W32.Spybot.worm (halleluja, and all praise Windows XP!) I’m having some very real difficulties removing it, mostly because I’m a bit of a novice.

I do have Norton AntiVirus. For some reason the Anti-Virus program can’t touch this particular worm, though, so I have to remove it manually. I’ve tried following the instructions [here](http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html), but run into a couple of snags.

First off, Norton strongly recommends that you backs up your registry before beginning this process. To do so, I have to install “valueadd\msft  
tbackup” from my Windows CD. Problem is, for some mysterious reason, I can’t access that file. When I open the “valueadd” folder on the Windows XP disk I get the message that I’m not allowed to “preview” the files in it. So, basically, I can’t find the file to install, and so I can’t back up my registry. That makes me nervous. Can anyone out there advise?

Secondly, I have to restart my computer in “Safe/VGA” mode. I don’t know how to do this with Windows XP. Help, anyone?

After that I have to run a full scan, go into the registry, and delete some stuff. I think I can follow the instructions on this last step, if only I get to that point.

If anyone can help me, or knows of an easier solution to this problem, I would be forever in your debt.

---

<div class="post-metadata">

**Author:** ![Chimpy](https://avatars.discourse-cdn.com/v4/letter/c/a9adbd/32.png) [@Chimpy](https://boards.straightdope.com/u/Chimpy)\
**Post date:** [August 27, 2004, 10:08am UTC](https://boards.straightdope.com/t/help-with-w32-spybot-worm/261767/2 "2004-08-27T10:08:42Z")

</div>

My dad had this worm and so I went through the removal over the phone with him, I had no problem with registry backups but to start Windows XP in safe mode is here: [http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec\_doc\_nam](http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam)

---

<div class="post-metadata">

**Author:** ![Mr.Svinlesha](https://avatars.discourse-cdn.com/v4/letter/m/22d042/32.png) [@Mr.Svinlesha](https://boards.straightdope.com/u/Mr.Svinlesha)\
**Post date:** [August 27, 2004, 11:07am UTC](https://boards.straightdope.com/t/help-with-w32-spybot-worm/261767/3 "2004-08-27T11:07:56Z")

</div>

[b]Chimpy\*\*:  
A million and one thanks.

Worked like a charm, apparently (I hope!), and now I am forever in your debt.

Happy trails,  
Mr. S

---

<div class="post-metadata">

**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\
**Post date:** [August 27, 2004, 12:14pm UTC](https://boards.straightdope.com/t/help-with-w32-spybot-worm/261767/4 "2004-08-27T12:14:21Z")

</div>

[Here are some instructions](http://www.siena.edu/antivirus/viruses/spybotworm.asp) if you’re still having problems.