# I need help with a virus/spyware issue I am having. **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [June 27, 2005, 4:10pm UTC](https://boards.straightdope.com/t/i-need-help-with-a-virus-spyware-issue-i-am-having/310055 "2005-06-27T16:10:22Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![RickQ](https://avatars.discourse-cdn.com/v4/letter/r/35a633/32.png) [@RickQ](https://boards.straightdope.com/u/RickQ)\ **Post date:** [June 27, 2005, 4:10pm UTC](https://boards.straightdope.com/t/i-need-help-with-a-virus-spyware-issue-i-am-having/310055/1 "2005-06-27T16:10:22Z")
Whenever I have an IE (I know, that is part of my problem) window open I get alerts from my AV software that it has found a few infected files. The files are detected as Troj\_buddy.f, troj\_stervis.c and troj\_nail.b. I have tried cleaning these off using the cleaning instructions listed on the website for the AV software, but that did not work. I have run scans with Spybot, Ad-aware, CWShredder, Hijack This, Mwav, Ewido and Ccleaner, Trend Micro 2004 (and their online scanner) in both normal mode and safe mode but that has not helped. I cleaned off all the spyware they found and deleted lots of entries from the run lines. One problem I have found but cannot get rid of is a small app which is running in the background. The name is a mixture on numbers, usually about 5 or 6 characters in length. Whenever I kill it, the process comes back with a different name. Memory usage is always 188k when it starts and then it changes to 196 or 202 or somewhere in the 350s. I have killed the process and searched for it and deleted the folder it appeared to be loading from, but that did not help. The process was running in the c:\Windows\system32 folder. If anyone has any ideas, I would be most grateful as it has been driving me nuts for several days. Each time I think I have it beaten, it comes back. Can anyone suggest any other steps I can take? ---
**Author:** ![The\_Surb](https://avatars.discourse-cdn.com/v4/letter/t/ce73a5/32.png) [@The\_Surb](https://boards.straightdope.com/u/The_Surb)\ **Post date:** [June 27, 2005, 7:59pm UTC](https://boards.straightdope.com/t/i-need-help-with-a-virus-spyware-issue-i-am-having/310055/2 "2005-06-27T19:59:26Z")
Have you tried deleting these files in safe-mode? My son had a virus/spyware that had three files that had to be deleted in safe-mode or it would keep returning. ---
**Author:** ![Bendarr](https://avatars.discourse-cdn.com/v4/letter/b/e56c9b/32.png) [@Bendarr](https://boards.straightdope.com/u/Bendarr)\ **Post date:** [June 27, 2005, 8:07pm UTC](https://boards.straightdope.com/t/i-need-help-with-a-virus-spyware-issue-i-am-having/310055/3 "2005-06-27T20:07:08Z")
You will also wish to make sure that “system restore” is turned off (assuming that your XP) before you try to delete the files as well. ---
**Author:** ![RickQ](https://avatars.discourse-cdn.com/v4/letter/r/35a633/32.png) [@RickQ](https://boards.straightdope.com/u/RickQ)\ **Post date:** [June 27, 2005, 8:27pm UTC](https://boards.straightdope.com/t/i-need-help-with-a-virus-spyware-issue-i-am-having/310055/4 "2005-06-27T20:27:25Z")
I tried deleting the process in Safe Mode but it still comes back. I cannot find where it is coming from. I have disabled system restore while doing the cleaning to no avail.