I need help with a virus/spyware issue I am having.

Whenever I have an IE (I know, that is part of my problem) window open I get alerts from my AV software that it has found a few infected files. The files are detected as Troj_buddy.f, troj_stervis.c and troj_nail.b. I have tried cleaning these off using the cleaning instructions listed on the website for the AV software, but that did not work.

I have run scans with Spybot, Ad-aware, CWShredder, Hijack This, Mwav, Ewido and Ccleaner, Trend Micro 2004 (and their online scanner) in both normal mode and safe mode but that has not helped. I cleaned off all the spyware they found and deleted lots of entries from the run lines.

One problem I have found but cannot get rid of is a small app which is running in the background. The name is a mixture on numbers, usually about 5 or 6 characters in length. Whenever I kill it, the process comes back with a different name. Memory usage is always 188k when it starts and then it changes to 196 or 202 or somewhere in the 350s. I have killed the process and searched for it and deleted the folder it appeared to be loading from, but that did not help. The process was running in the c:\Windows\system32 folder.

If anyone has any ideas, I would be most grateful as it has been driving me nuts for several days. Each time I think I have it beaten, it comes back.

Can anyone suggest any other steps I can take?

Have you tried deleting these files in safe-mode? My son had a virus/spyware that had three files that had to be deleted in safe-mode or it would keep returning.

You will also wish to make sure that “system restore” is turned off (assuming that your XP) before you try to delete the files as well.

I tried deleting the process in Safe Mode but it still comes back. I cannot find where it is coming from.

I have disabled system restore while doing the cleaning to no avail.