Pieter_Arntz
December 29th, 2004, 02:23 PM
This one is a bit hard to remove since the installer is actively hiding from Windows in normal mode.
Boot into safe mode and run HijackThis there.
It will tell you the filenames you need, but don't fix anything yet.
First remove the file and folder.
Then fix the offending entries and reboot.
Log example:
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINNT\EliteToolBar\EliteToolBar version 59.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINNT\EliteToolBar\EliteToolBar version 59.dll
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvfaw32.exe
The name of the startup entry for the file C:\winnt\system32\kalvfaw32.exe
and the folder C:\WINNT\EliteToolBar are always the same. The name of the file itself will be similar but random.
After cleaning copy the text in bold below to Notepad, and save in a location of your choice as elitefix.reg (Set filetype to 'all files')
Doubleclick the file we made and confirm you want to merge it with the Registry.
REGEDIT4
[-HKEY_CURRENT_USER\Software\LQ]
[-HKEY_LOCAL_MACHINE\SOFTWARE\ohbbackup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Elitum]
Credit to TonyKlein
Boot into safe mode and run HijackThis there.
It will tell you the filenames you need, but don't fix anything yet.
First remove the file and folder.
Then fix the offending entries and reboot.
Log example:
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINNT\EliteToolBar\EliteToolBar version 59.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINNT\EliteToolBar\EliteToolBar version 59.dll
O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvfaw32.exe
The name of the startup entry for the file C:\winnt\system32\kalvfaw32.exe
and the folder C:\WINNT\EliteToolBar are always the same. The name of the file itself will be similar but random.
After cleaning copy the text in bold below to Notepad, and save in a location of your choice as elitefix.reg (Set filetype to 'all files')
Doubleclick the file we made and confirm you want to merge it with the Registry.
REGEDIT4
[-HKEY_CURRENT_USER\Software\LQ]
[-HKEY_LOCAL_MACHINE\SOFTWARE\ohbbackup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Elitum]
Credit to TonyKlein