Self spawning process

[Kipp Woodard]

I have a WinXP Home system that starts a process named pelus4.exe. It also
has a sub-process of the same name. It is supposed to be running from
C:\Windows\System32, though there is no such file there. If I kill one of
the processes, it spawns a new process of a different name, again an EXE
supposed to be in system32 that I can not see. If I continue killing each
new process, it cycles through about 6 names, and then starts again using
pelus4.exe. It is always the same series of file names. They are not
randomly generated. If I suspend both processes then I can kill them both
without them being respawned. They will, of course, be started again when
the system is rebooted.

NAV doesn't find it.
Spybot doesn't find it.
SpyHunter doesn't find it.
SpyKiller doesn't find it.

I can't find anything in the registry that I can see is related to this
process.

I have found no references to the various file names using any internet
searches (google, etc.).

I am at a loss. How does it start? What is it doing?

 

[Curtis Clay III [MSFT]]

Hello Kipp,
You may want to open a case with Microsoft. It's free for virus cases.
This maybe the work of a trojan.

This posting is provided "AS IS" with no warranties, and confers no rights.