Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My Nod32 have been catching something that is apparently identified as Python/Lesta.A worm. No matter how many times I tell Nod32 to delete and quarantine the file, it always re-appear, the situation will repeat about 3-4 times a day.

This thing has been creating a folder called "pamela" in one of my drives, it sometimes also creates a "xxx.folder" file, which Nod32 identifies as "Exploit/CodeBase virus".

I have Googled, and done pretty much everything related to this: a full scan in safe mode with no networking turned on, and also ran Ad-Aware, SpyBot, SpyHunter, ComboFix and cleaned the registry.

Any idea how I can completely get rid of this annoying virus/worm?

share|improve this question

You can find information about manually removing it. In particular, backup your registry then try removing the key:


You can find many tutorials for using the registry.

share|improve this answer

Its probably a rootkit, try GMER to identify and remove it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.