Spyware Ardakey

Thanks.  I have Windows 2000 server which does not have sytem restore that I know of.   Can you think of any other solution?

I do not see any reference to Spyware Ardakey in programs or task manager.   It looks like its not there.  
Yet, it comes back each time when the scan detects it.  

I got it again tonight.  The notification from Symantec Antivirus says the threat is Spyware Ardakey
File: C:\WINNT\System32\dllcache\svchost.exe
Location: C:\WINNT\System32\dllcache
Action Taken: Leave Alone succceeded
It looks like the antivirus program does not delete the spyware, but informs that it is present because it is a system file that looks infected and deleting it could be a problem.  I'm not sure how to get rid of this.
If the keylogger is in dllcache, what can I do to remove it without damaging the system?

Try this tool, we need to look at the log afterwards also to make sure it's clean.

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
(If it doesn't run, re-download but rename before saving to your desktop)

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..


Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.



If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Thanks rpggamergirl.   The research that I did tells me that svchost.exe would not be infected, but a program running svchost would be what is infected.  There is a program called Process Explorer that I fond out about which will list all the processes that run svchost, much like tasklist.  Have you heard of this and should I start there?   Since the pc with this problem is a server, I would not want to shut it down or stop processing during the day because many people in the office are connected to it . If it is a mjor problem, the that is a different story.  

Symantec tech support was able to resolve the issue by emailing me the link to a security scan.  The scan found the spyware.  I need to install a later version of their corporate antivirus after I get some more room on my server.  Thanks to rpggamergirl anf priceD for their help.  I will split the points to each of you.