MidADdle MUST DIE

[Dshadna]

Update:
We believe we've solved the problem of the windows constantly popping up when hitting the "s" key. It appears that the Numerical Enter key was stuck in the down position and so we first unplugged it from the pc and then popped that key up and off and found that the metal clip under it was not on correctly, so we put it back in right and cleaned out from under it. We popped it back on and then replugged it in. We followed the directions for uninstalling the keyboard and then reinstalling so that the driver would update when we did it and now it appears that everything is working normally.

As to the Wild Tangent error, we reinstalled Wild Tangent and then did a complete Uninstall to rid ourselves of that particular problem. Thanks ya'll for all the help. We're planning on replaceing the almost 4 year old keyboard next week when SSD comes in. She's had problems with it since we got it, but this just has made us more certian that we're ready to replace it. She doesn't use half the keys on it anyway.

I know that if we have any more problems I can always come back here and some great people will continue to help us until we can solve the problem. Thanks everyone for suggestions and all. One great thing about this Midaddle/Stuck key is that we now have her computer extremely protected with AdAwareSE, Spybot/TeaTimer, Zonelabs and Spyblaster, amoung the few. I've wanted her to get them before, but this situation impressed upon her just why. Thanks for helping us.

[NooNoo]

Anytime

[rihay]

Hello DSHADNA:

it is obviously that your problem is not ony midaddle you have other spybots and virus running on the background. such as

smsss.exe
s.exe.
you need to get rid off them the same way that you are trying to del midaddle.. it should work.

and so on..

Ok this will be long as I'm going to take you step by step with what we've done to try to get midADdle off of my partner's computer.

First, we realized something was wrong on July 31, 2004 when she opened an email from a trusted friend that had an attachment. When she went to send the email to her son, **it hit the fan with her computer and it began popping up 3 and 4 instances of the same window and sending the email 3-4 times to her son. She immedatily called him and told him to simply delete any email from her until further notice and we sent an email from my computer which hasn't been affected to let anyone on her email list know to delete all emails from her until further notice.

I began searching to find what could be the problem and midaddle jumped out for some reason, and so we searched her computer to see if it was on it and found several instances of it. I then began searching for ways to rid her computer of it. Following is the detailed list of what we have done and things we've discovered in the process. We also found these and were able to remove successfully.

1. Program Files/SEP/SEP.dll
2. Software/Memory Watcher
3. C: Documentandsettings/sharonbass/localsettings/temp/fixit.exe
4. Docummentandsettings/sharonbass/localsettings/temp/middaddle.exe

We began by running her adaware and it found several instances also of MidADdle and so we deleted/quaranteened them. That however did not solve the problem. I again began searching for even more information after realizeing that it is MalWare.

I found these instructions on 2 different sites that were talking specifically about MidADdle that others said worked for them. It did delete them, temporarliy, but it's come back. Here are the step by step instructions that I followed.

1. Disconnect from the internet.
2. Restart Computer
3. Run
4. Msconfig
5. Select Diagnostic Startup
6. click ok computer will restart
7. Start
8. Run
9. Regedit
10. Select Find
11. Type MidADdle and find next
12. Delete Files/keys that are specifically MidADdle
13. Repeat until all instances are removed
14. After deleting all of these, go to
15. C: PRogram Files/Common Files
16. Find MidADdle and delete (SOmetimes it would let us delete and sometimes it would not)
17. Go to start
18. Run
19. Msconfig
20. Normal Start up (Her's was in selective startup)

These are the things that I found with MidADdle while in the registry.

• HKEY_LocalMachines.software/{E8EAEB34-F7B5-4C55-87FF-7s0FAF53D84}
• HKEY_Classes_ROOT:CLSID\{E8EAEB34-F7B5-4C55-87FF-7s0FAF53D84}
• HKEY_CLASSES_ROOT:TYPELIB WINAFFILIATE BHO.WINAFFILIATE.IEEXTENS.1
• {E8EAEB34-F7B5-4C55-87FF-7s0FAF53D841}
• C: Documents and SEtting/SharonBass/Local Setting/Temporary INternet/Content.ie5/0v1266v
• C:Program files/common files/Midaddle/midaddle.dll
• Something about File Rename that had midaddle in it, so we deleted it.
• Something about Threading with Midaddle and apartment in it, so we deleted it.

We deleted these and then went back into normal mode. Here is some fun begins, but we learned something in the process. We found that while in Diagnositc or Safe Mode, these could be deleted. Last night, after making certian that all things were off the computer concerning MidADdle, we turned off her computer and this morning turned it back on, and went straight to the Programfiles/Common files and this is what we found Midaddle.dll 116KB

They at first reappeared only when she went to Neopets.com or Roadrunner. This morning they reappeared simply when she turned on her computer. She hadn't even gone on the net.

She runs AVG and keeps it updated faithfully. She is using XP's Firewall. (This is where we differ, I also use ZONELABS and my computer has not been affected by any of this).

Does anyone have a reliable way to rid her computer of this crap? I've let her know that you all will most likely recommend that she download Hijack This to be able to read what is on her pc, and she's hesitienat, but I think she is finally reaching a point where she will allow me to get it set up and run on her computer.

Thanks in advance for all your help.

[Dshadna]

I've already taken care of the s.exe.

Did some reading on the smss.exe
and it appears to be a legitmeate part of the windowXP operating system. I'll wait for NooNoo or Hudson to correct me if that is wrong.

smss - smss.exe - Process Information

Process File: smss or smss.exe
Process Name: Session Manager Subsystem
Description: Application that is used to start, manage, and delete user sessions or client sessions under Terminal Server.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A

[NooNoo]

rihay posted about smsss.exe - an extra s makes ALL the difference. Check the spelling of the file in your processes Dshadna!!

rihay, thanks for the tip!

[Dshadna]

rihay posted about smsss.exe - an extra s makes ALL the difference. Check the spelling of the file in your processes Dshadna!!

rihay, thanks for the tip!

This is what he posted in another place where I had been looking for ways to rid the pc of MidADdle. This is why I double checked what process he was talking about and why I am hestiant to follow his directions.

Dshadna : I took a look @ your log that you posted on windrivers.. and it looks like you have several spybots and virus..not to mention the DAMN midadle..
your doing everything so far... with the instructions but you keep leavign some of the spybots and viruses out .. and thats what keeps bringing midadle back. THESE ARE NOT TO BE RUNNING ON YOUR SYSTEM AT ALL AND THIS GOES FOR EVERYONE.

smss.exe
lsass.exe
vONA.exe
S.exe
pctspk.exe
wkcalrem.exe

This is what I found by checking http://computercops.biz/sl-100.html

smss.exe--Session Manager Subsystem
Description: Application that is used to start, manage, and delete user sessions or client sessions under Terminal Server. (Legitimate running smss.exe is found in System32 subdirectory)
Mine is found here:C:\WINDOWS\System32\smss.exe

lsass.exe --Local Security Authentication Server
Description: Windows Local Security Authority Server Process handles Windows security mechanisms. It verifies the validity of user logons to your computer or server. Technically, the software generates the process that is responsible for authenticating users for the Winlogon service.

--also found this when searching the computercops startup list.
lsass.exe--Added as a result of the RANDEX.AR VIRUS! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!

How do I know which one is legimetate and which one isn't?
Mine is found here: C:\WINDOWS\system32\lsass.exe


vONA.exe --Already taken care of

S.exe--Already taken care of

pctspk.exe--Used for modems based upon PC-TEL chipsets. Normally used for some Voice and Speakerphone functions and also for some Power management options. If you remove it you may not be able to use any of those functions
Mine is found here: C:\WINDOWS\System32\pctspk.exe

wkcalrem.exe--Produces a pop-up reminder of events scheduled using the MS Works Calendar
Mine is found here: C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe


I just want to be very sure before I do anything else to the pc. I don't want to delete something that is necessary for the running of the pc or for a program we use, such as Microsoft Works Reminder for the Calender, which we do use. Maybe I am too cautious, but the pc is running correctly now and there has been nothing found with Spybot, SpywareBlaster, Adaware or anything else. Please, NooNoo or Hudson, will you double check the first log that I put in to be certian for me. I can repost it again if you prefer, but it will take some time to get a new log for posting.

[NooNoo]

How do I know which one is legimetate and which one isn't?
Mine is found here: C:\WINDOWS\system32\lsass.exe

That's the correct - but does it figure in the msconfig startup tab? If it does, its not right.

[Dshadna]

Checked the msconfig startup tab and neither the smss.exe or
lsass.exe are found there. I'm assuming that means these are the correct ones?


Thanks NooNoo for your prompt reply. I would have replied sooner, but haven't been able to get to my friend's pc to check out what you asked.

[NooNoo]

they are indeed the correct ones if they do not appear in the startup tab.