Ok, last evening I wanted to play some blackjack just for fun without losing any money. I googled around and found Blackjack Elf on www.dirfile.com (http://www.dirfile.com/black_jack_elf.htm)
dir.com looked like a serious freeware stuff site.
But the bad boys have put their stuff there.
At the installation my anti-virus program warned about c:\temp\optimize.exe something 'ooops'.
I stopped the installation but to late. Ok I thought, I'll fix this with SpyBot or AD-Aware plus a virus scan.
Suddenly Internet Explorer started to open windows with ad's for gambling sites or for medicals EVERY 30 s, annoying!!!
Started with SpyBot, it found a couple of thing that I removed but it didn't help.
Used HijackThis to remove suspicious start-up, still same f£€king popups.
Ran AVG antivirus but it didn't found a thing.
AD-Aware found a lot of stuff mainly EliteBar.B Ad-Ware but not the evil of all mothers, so after removing the bad stuff I got the same popups again.
Next step, I try location what application was activated at startup, found a candidate elitebvx32.exe, aha that's it.
It is located in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
under the name antiware, (they thing of everything this bad boys).
I googled looking for help about this but I didn't get a hit.
Strange, am I the only one or is this a newly created 'makememad'-ware.
I remove it in the registry but it is created again after 30 s or so.
The file elitebvx32.exe was located in c:\windows\system32, so I tried to remove it.
But I can't find it there, I have set explorer to show everything but its not there!
Then I got the idea to just put an empty file with the name elitebvx32.exe so it should do any harm and make it read-only so it shouldn't be easily overwritten.
But when triyng that move I get the message, there is already a file with that name and you can't overwrite it!
It not shown in the Tasklist under processes either so no luck stopping it there.
I got Microsoft Antispyware Beta1 up my sleeve, now the bad stuff will go away for good, but it didn't do more than Ad-Aware it spotted the EliteBar.B stuff but when I removed it but it came back again.
I installed good old Norton antivirus 2004, it found a lot of stuff including EliteBar it also found some Dc67, Dc7 adware that I removed.
The IE popups has stopped but when I check the registry the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antiware is recreated, remove it and it is recreated within seconds.
There is also some settings in the registry that is updated every 3rd s or so it is HKEY_CURRENT_USER\Software\LQ
there I found some reference to a Dll EliteToolBar.dll, googling for that and I know that I wasn't alone about the problem with EliteToolBar.
I also made a good old DOS (not the real stuff using XP) search command; dir elite* /s that found a directory 'EliteSideBar' and the irritating elitebvx32.exe in /system32/. None of this will be viewed with Explorer due (settings: view every possible things!)
Searching for EliteToolBar.dll I found a tool called CWShredder that will do the trick to get rid of elitetoolbar for good I hope.
Another problem I found was that how do you start the PC in Safe Mode when using Grub? (Grub is some boot up stuff that is used for running multiple OS on my PC i.e Linux.)
I tried F8 and Ctrl at startup but Win XP will not enter Safe Mode .
I got the Grub - Safe Mode how-to:
In Grub select option 'Splash' and press F8 when windows starts, viola.
In 'Safe mode I removed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antiware
HKEY_CURRENT_USER\Software\LQ, the whole section.
Then deleted directories 'EliteToolbar' and 'EliteSidebar' in C:\Windows
In c:\Windows\system32\ i remove everything starting with Elite*, Elitedoolsav.dat, eliteerror32.dat and the viscous elitebvx32.exe.
then I run AD-Aware that found another 35 records of EliteBar in the registry.
Restarted in normal mode and back to uninfected mode, I hope.
