Elite Toolbar

Discussion in 'spyware news and general information' started by Pieter_Arntz, Dec 29, 2004.

Thread Status:
Not open for further replies.
  1. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    This one is a bit hard to remove since the installer is actively hiding from Windows in normal mode.

    Boot into safe mode and run HijackThis there.
    It will tell you the filenames you need, but don't fix anything yet.
    First remove the file and folder.
    Then fix the offending entries and reboot.

    Log example:
    O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINNT\EliteToolBar\EliteToolBar version 59.dll
    O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINNT\EliteToolBar\EliteToolBar version 59.dll

    O4 - HKLM\..\Run: [kalvsys] C:\winnt\system32\kalvfaw32.exe

    The name of the startup entry for the file C:\winnt\system32\kalvfaw32.exe
    and the folder C:\WINNT\EliteToolBar are always the same. The name of the file itself will be similar but random.

    After cleaning copy the text in bold below to Notepad, and save in a location of your choice as elitefix.reg (Set filetype to 'all files')

    Doubleclick the file we made and confirm you want to merge it with the Registry.


    REGEDIT4

    [-HKEY_CURRENT_USER\Software\LQ]

    [-HKEY_LOCAL_MACHINE\SOFTWARE\ohbbackup]

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Elitum]


    Credit to TonyKlein
     
    Last edited: Dec 30, 2004
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.