well i don't know the particulars of the virus but i couldnt find which process it was attached to (the parent process that kept running the main program) so the process tree wouldnt work unless i knew which one. i needed to find out which process and it turned out to be explorer itself. and that program i mentioned meant i didnt have to kill explorer to terminate the virus. i was ending process tree with what i thought was the virus but the program was somehow attached to explorer and would just keep running itself every time it was teminated.