# Riddled with trojans

**URL:** <https://boards.straightdope.com/t/riddled-with-trojans/227653>\
**Category:** Factual Questions\
**Created:** [February 5, 2004, 12:13pm UTC](https://boards.straightdope.com/t/riddled-with-trojans/227653 "2004-02-05T12:13:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![remisser](https://avatars.discourse-cdn.com/v4/letter/r/b3f665/32.png) [@remisser](https://boards.straightdope.com/u/remisser)\
**Post date:** [February 5, 2004, 12:13pm UTC](https://boards.straightdope.com/t/riddled-with-trojans/227653/1 "2004-02-05T12:13:24Z")

</div>

Hey all,  
I could find little information on this on the internet, so maybe someone could help:  
A few days ago I opened internet explorer and had [http://www.magicsearch.ws](http://www.magicsearch.ws) forced as my homepage and default search engine. Immediately curious as to how this was forced upon me, I looked at the running processes on my computer and noticed a strange one:  
sistem.exe

I deleted it, and a key it put in my registry, but that doesn’t seem to be a full solution. I look in the directory it was in and I see the following files that are the same exact size (23KB), three of which I KNOW are trojans:  
sisteem.exe  
directx32.exe  
inetinf.exe  
smart.exe  
users32.exe

So, my question is: Where can I find a fix or patch to a) kill the trojan and b) innoculate me from further attacks? I have that free virus scanning software AVG – but it didn’t even notice any of those files.

What can I do? (sistem.exe respawned itself, by the by.)

---

<div class="post-metadata">

**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\
**Post date:** [February 5, 2004, 12:37pm UTC](https://boards.straightdope.com/t/riddled-with-trojans/227653/2 "2004-02-05T12:37:11Z")

</div>

Sounds more like spyware than actual trojans (which would explain AVG not finding them) - I’d recommend a scan with one of the many spyware killers, such as AdAware or Spybot.

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [February 5, 2004, 2:57pm UTC](https://boards.straightdope.com/t/riddled-with-trojans/227653/3 "2004-02-05T14:57:28Z")

</div>

sisystem.exe is part of the CoolWebSearch spyware program. AdAware and Spybot have a problem removing it, but there is a good tool called [CWShredder](http://www.spywareinfo.com/~merijn/downloads.html) that cleans out all CWS components.