I can't kill EliteBar

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by sighlentex, Jan 19, 2005.

  1. sighlentex

    sighlentex Private E-2

    i've been here before with similar issues, so i know the drill, and i've run all the little fixes, but i feel like i'm just scratching the surface of my problem. no matter what i do i still have SOMETHING wrong! it's incredibly frustrating.

    i was reading someones 'blog' the other day and ended up with a pop-up telling me that i was out of resources, and that "elite toolbar" couldn't run. i did some hunting and saw that AdAware would help with that little issue, so i used it and was really shocked to see all the TRASH that was on my machine! i thought i was 'clean!'

    i assumed everything was gone, but when i ran a HJT scan a few minutes ago i see that now i've got

    R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\PROGRAM FILES\JUSEARCH\SEARCHENH1.DLL

    to go along with

    O4 - HKCU\..\Run: [spc_w] "C:\Program Files\JUSearch\juspc.exe" -w

    and O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll

    it seems like when i'm cleaning my machine of this stuff that i'm missing something, so that HaHa the jokes on me, it mutates and changes names. i can't figure it out. (i think SearchMiracle-which i also ha(d)(ve) and EliteBar are the same thing under different names.)

    i'm not trying to ramble on and on, but i'm exhausted, and incredibly aggravated!

    i'm attaching my HJT log.

    Thank you.
     

    Attached Files:

  2. tigerray00

    tigerray00 Specialist

  3. TheOldThug

    TheOldThug First Sergeant

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This next line should be fix using HijackThis:

    O15 - Trusted Zone: www.uproar.com

    As far as these two:
    R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\PROGRAM FILES\JUSEARCH\SEARCHENH1.DLL
    O4 - HKCU\..\Run: [spc_w] "C:\Program Files\JUSearch\juspc.exe" -w

    It would appear that you use Juno and these are part of what they loaded on your system. I believe it is their variation of NetZero's search. If you don't want them or need them you should probably first look to see if they can be uninstalled using Add/Remove programs.

    The last item you questioned:
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll

    This is legit. It's part of Adobe Acrobat Reader.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds