File Investigation Report
ELISTARA.EXE
Malware DownloaderPC Cleanup in 3 Easy Steps
Use Prevx 3.0 to remove ELISTARA.EXE, along with any other viruses, spyware, adware, trojans, rootkits, worms, information stealers, keyloggers, bots, and other form of malicious threat that may reside on your PC.
- Think your PC might be Infected? Scan Now Prevx 3.0 will scan your PC in seconds to inform you whether your PC is clean or infected.
- Malware Removal Prevx 3.0 removes adware infections for free. More complicated infections require purchase of a malware removal license.
- Expert Assistance In the rare occurence that Prevx 3.0 malware removal fails - a Prevx Engineer will connect to your PC and manually disinfect.
- Money Back Guarantee for Individual Users If within the first 14 days, the Prevx Engineer finds it impossible to clean an infection from your PC, we give you your money back.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Malware Downloader
File Behavior
ELISTARA.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Terminates Processes
- Deletes Links in the Start Menu
- Deletes an ActiveX component
- This Process Deletes Other Processes From Disk
- Modifies Windows Security Policies to restrict/expand User Privileges on the machine
- Executes a Process
- Disables the Windows Built in Firewall enabling rogue processes to access the internet without your knowledge or permission
- Changes the Internet Explorer Home Page Settings
- Changes to the file command map within the registry
- Changes the Internet Explorer Search Page
- Adds a Registry Key (RUNONCE) to auto start Programs on system start up
- Modifies Windows Initialization And System Settings Used On Start up
- Modifies the Windows Host File which could be used to stop you visiting specific web sites by redirecting you to alternative addresses without you knowing
- Registers a Dynamic Link Library File
- Makes outbound connections to other computers using NETBIOSOUT protocols
- This Process can access Web Mail Servers
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Registers a Windows APPINIT DLL To be loaded in all processes
- Creates new file extentions so that Internet Explorer will automatically open and potentially execute additional file types
- Disables the built in Windows File Protection System
- This process creates other processes on disk
- Modifies the way Internet Explorer Operates
- This Process Disables Other Security Products
- Adds new menu items in the Internet Explorer Right Click menu
ELISTARA.EXE has been the subject of the following behavior:
- Added as a Registry Key (RUNONCE) to auto start Programs on system start up
- Executed as a Process
- Created by processes which appear to be checking for interception by security products
- Created as a process on disk
- Deleted as a process from disk
- Executed by Internet Explorer
- Has code inserted into its Virtual Memory space by other programs
- Terminated as a Process
Country Of Origin
The filename ELISTARA.EXE was first seen on Jul 29 2007 in the following geographical regions of the Prevx community:
- Uruguay on Jul 29 2007
- Spain on Jul 1 2008
- Nicaragua on Jul 24 2009
- Colombia on Mar 12 2010
- Peru on Mar 12 2010
Filesizes
The following file size has been seen:
- 594,443 bytes
- 300,566 bytes
- 693,771 bytes
- 393,216 bytes
File Type
The filename ELISTARA.EXE refers to many versions of an executable program.
File Activity
One or more files with the name ELISTARA.EXE creates, deletes, copies or moves the following files and folders:
- Deletes c:\WINLOGON.EXE
- Deletes c:\windows\MSINFER.EXE
- Deletes c:\windows\system32\INTENATS.EXE
- Deletes c:\windows\system32\SYSFILE.EXE
- Deletes c:\windows\system32\WIDOWS.EXE
- Deletes c:\windows\system32\SMSSU.EXE
- Deletes c:\windows\system32\TMNTSRV32.EXE
- Deletes c:\windows\system32\ALGU.EXE
- Deletes c:\windows\system32\SPOOLSV32.EXE
- Deletes c:\windows\EXPLORER32DBG.EXE
- Deletes c:\windows\IEXPLORE_DBG.EXE
- Deletes c:\windows\XMLLIB.DLL
- Deletes c:\windows\ATLASS.DLL
- Deletes c:\program files\common files\microsoft shared\msinfo\info32.exe
- Deletes c:\windows\system32\SVCC.EXE
- Deletes c:\documents and settings\user\start menu\programs\startup\Start.exe
- Deletes c:\documents and settings\all users\start menu\programs\startup\Start.exe
- Deletes c:\windows\system32\CTRLPAN.DL
- Deletes c:\windows\system32\MTWIRL.DLL
- Deletes c:\windows\system32\CIDFT.DLL
- Deletes c:\windows\system32\CIDPOQ32.DLL
- Deletes c:\windows\system32\GUPD.DLL
- Deletes c:\windows\system32\ICNFE.DLL
- Deletes c:\windows\system32\ICQRT.DLL
- Deletes c:\windows\system32\ICVBR.DLL
- Deletes c:\windows\system32\MTWCNL32.DLL
- Deletes c:\windows\system32\NTHST32.DLL
- Deletes c:\windows\system32\SDFUP.DLL
- Deletes c:\windows\system32\WECXG32.DLL
- Deletes c:\windows\system32\XCWER32.DLL
- Deletes c:\windows\system32\ZXMSN.DLL
- Deletes c:\windows\system32\HANDLESYS.EXE
- Deletes c:\windows\system32\UEWXDIR.EXE
- Deletes c:\windows\AWINRAR.EXE
- Deletes c:\windows\SH.EXE
- Deletes c:\windows\system32\MSPROTO3.DLL
- Deletes c:\windows\system32\MSXMLPP.DLL
- Deletes c:\windows\ADDCLS.EXE
- Deletes c:\windows\DP.DLL
- Deletes c:\windows\ADDCLASS.EXE
- Deletes c:\docume~1\user\locals~1\temp\ADDCLASS.EXE
- Deletes c:\windows\system32\SYSTEM32.DL
- Deletes c:\windows\system32\SYSTEM32.EX
- Deletes c:\windows\system32\WINMM64.EXE
- Deletes c:\windows\DLLHELP.EXE
- Deletes c:\docume~1\user\locals~1\temp\SP.DLL
- Deletes c:\docume~1\user\locals~1\temp\SE.DLL
- Deletes c:\windows\system32\MSXMLFILT.DLL
- Deletes c:\windows\system32\SEARCHSETTER.EXE
- Deletes c:\windows\system32\ADTMKA.EXE
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.