elitessp32.exe

[murtha]

I've got a nasty something I can't get rid of, and my cpu's mussed up, too. I've rebooted in safe mode, run Ad-Aware, CWShredder, Registry Mechanic, and AboutBuster. What follows is my HJT log. I'm pretty sure

C:\Documents and Settings\Craig\dddd.exe
O2 - BHO: (no name) - {8A3F35D4-0461-7989-E810-2191EC593D59} - (no file)
O4 - HKLM\..\Run: [antiware] c:\windows\system32\elitessp32.exe

are the problems. I've tried 'fixing' them in HJT, but they just come back. I've also tried manually deleting them in safe mode, to no avail. Plz help!

Logfile of HijackThis v1.98.2
Scan saved at 7:24:53 PM, on 2/11/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\Documents and Settings\Craig\dddd.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Craig\Desktop\hijackthis\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Craig\Desktop\&^%$#@!\avg70free_300a419.exe
C:\DOCUME~1\Craig\LOCALS~1\Temp\RarSFX0\avgsetup.e xe

O2 - BHO: (no name) - {8A3F35D4-0461-7989-E810-2191EC593D59} - (no file)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 4.exe
O4 - HKLM\..\Run: [sureshotpopupkiller] "C:\Program Files\Stop-the-Pop-Up\stopthepop.exe" -minimized
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [antiware] c:\windows\system32\elitessp32.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe

[nightowl]

Hi Murtha,This is the worst I've seen. Its Criminal if you ask me. Its new and there is no fix as of yet. Either wait for someone to come up with a fix or reinstall Windows. I tried to fix a log the other day, the more I fixed the worst it got. Best to leave it for now........Jim :eww

[murtha]

Ya, i read around and this dddd.exe looks bad. Hopefully someone will create a fix soon. I had a little luck searching for files ending in exe, then deleting the suspicious ones created today (when i started having dddd.exe troubles). hopefully it'll stick.

[nightowl]

I really like to help with this stuff, but the best advice now is to wait or reinstall. Stay tuned, If I find a Fix it will be posted in the Spyware Reference section.........Jim :vivi

[murtha]

Alright, I think I got that nastyness off my machine. Just a few things I need help tidying up. Of concern:


O2 - BHO: (no name) - {8A3F35D4-0461-7989-E810-2191EC593D59} - (no file)

O15 - Trusted Zone: *.finefind.nettraffic2cash.biz

I keep 'fixing' these, and they keep coming back. I think I fixed these manually, and there's just a ghost in HJT.


O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)

May have accidentally deleted this file, whoops.



Here's my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 5:51:56 PM, on 2/21/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 4.exe
C:\Program Files\Stop-the-Pop-Up\stopthepop.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Craig\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {8A3F35D4-0461-7989-E810-2191EC593D59} - (no file)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 4.exe
O4 - HKLM\..\Run: [sureshotpopupkiller] "C:\Program Files\Stop-the-Pop-Up\stopthepop.exe" -minimized
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Documents and Settings\Craig\Desktop\2-18\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [KAV50] "C:\Documents and Settings\Craig\Desktop\last chance\kav.exe" -run -n PersonalPro -v 5.0.0.0 -chkss
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Kaspersky Anti-Virus Service (KLBLMain) - Kaspersky Lab - C:\Documents and Settings\Craig\Desktop\last chance\kavmm.exe

[nightowl]

http://forums.designtechnica.com/showthread.php?t=5583

Download Spybot, AdAware, Hijack This (Links Above)

Reboot To Safe Mode (tap F8 on Startup)

Place a check next to each of these and click Fix Checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {8A3F35D4-0461-7989-E810-2191EC593D59} - (no file)
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz

Still In Safe Mode Delete all Temporary Internet Files, Cookies, Run AdAware and Spybot,delete what they find , Empty recycle bin.

Then Reboot and post a new log..........Jim


info on dmadmin.exe

http://www.liutilities.com/products/wintaskspro/processlibrary/dmadmin/

Veritas Software, If you have this software you may be able to reinstall it?