Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.



  • Please log in to reply
1 reply to this topic

#1 GorcheR


  • Members
  • 1 posts
  • Local time:06:39 PM

Posted 07 May 2005 - 08:39 AM

I've had this virus on my computer for the last week since my sister downloaded something... I normally have little problem getting them off but this one seems unremoveable. Below i'll list some things i've attempted, please let me know if you know of anything that could possibly remove this.

registry information on the virus:

name: checkrun
data: c:/windows/system32/elitewor32.exe

I began by running some of the more popular spyware removers including ad-aware and spybot seach & destroy. These were useful in removing about 40 other viruses that managed to make there way onto my computer with whatever was downloaded. Unfortunately these were unsuccessful in removing elitewor32.exe even though i had promted whether or not i would like to delete the registry entry elitewor32.exe. The problem is i am unable to find the actual file in the system32 folder. I have tried going into the registry and manually deleting elitewor32.exe and then looking for it in the system32 folder to delete it there but i was unsuccessful. Please leave any information on to what else i can try.

Another thing that worried me was a registry entry named TheIntranet because i have never seen this entry before... I also tried deleting this in my registry then removing it manually from the system32 folder but it would not allow me to delete the program TheIntranet.... maybe i'm stupid and this is some necessary system utility but i can't recall ever seeing it before.

BC AdBot (Login to Remove)


#2 tg1911


    Lord Spam Magnet

  • Members
  • 19,274 posts
  • Gender:Male
  • Location:SW Louisiana
  • Local time:05:39 PM

Posted 07 May 2005 - 12:48 PM

elitewor32.exe is associated with the program etbrun

Process Name : etbrun
File Name : elite***32.exe [* = random char]
Description: EliteBar adware variant
Rating: Typically viruses, spyware, adware and resource hogs.

Have you tried running your scans in Safe Mode?
How to start Windows in Safe Mode
Make sure all of your programs are updated before running them.

If that doesn't work, run these 2 online scans:

If you're still having problems, submit a HijackThis log for examination.

Read the pinned post in the HijackThis forum, here
Please read, and follow, all directions carefully.

Then, run a log, and post it in the HJT forum, at this link. Do not, fix anything, yet.
A member, of the HJT Team, will help you out.
It may take a while to get a response, because the HJT Team are very busy. Please, be patient, these people are volunteers. They will help you out, as soon as possible.

Once you have made the post, please, DO NOT make another post in the HJT forum, until it has been responded to by a member of the HJT Team. The first thing they look for, when looking for logs to reply to, is 0 replies. If you make another post, there will be 1 reply. The team member, glancing over the replies, might assume someone is already helping you out, and will not respond. So, just make your post, and let it sit there, until a team member responds. This way you will be taken care of, in the most timely manner.
MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users