SearchMiracle Toolbar Problem

HijackThis is not the first step! And we have guidelines about when and how to post HJT logs. Read below.

Note: Your WinXP and Internet Explorer are out of date with current updates. You need to get updated (this is covered in the READ ME FIRST thread below).

Please follow all the steps in this Sticky thread < READ ME FIRST: Basic Spyware, Trojan And Virus Removal >

If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.

NOTE: You should read the tutorial in this Sticky thread < Hijack This Tutorial And How To Post Your Log File > Do not post a HijackThis log until we ask you to and when we do it must be text document attachment to your message.

Update! Due to Hijack This logs destroying search engine and web site searches, we now ask you do not post your Hijack This log file unless requested by us. It is for advanced users, so if you do not understand how to use it, you do not need it....yet. Instead, please tell us in your post what symptoms you are experiencing so we can try and resolve it that way. When, and if, we ask you to post your log file, please attach it as a file. To do this save the log file and select manage attachments in a new thread to upload it. All running programs should be closed, including your web browser, e-mail, items in the tray, anything you can close... Close before running Hijack This!

Do NOT run Hijack This from the Desktop, a temp folder or choose run from the download. Place it in its own folder, for example C:\Program Files\HJT


The main part of your problem is due to the below two lines but we need to follow through the above steps first before working directly on your HJT log:
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\EliteBar version 46.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\EliteBar version 46.dll

You should check Add/Remove programs list to see if this has an uninstall.

If not cleaned up by scans, we will fix by hand.

 

Are you running up to date antivirus? Places like Nortons have removal steps, but its a pain:

http://sarc.com/avcenter/venc/data/pf/adware.cdt.html

You said you did "most" things meaning you skipped steps, not a good way for us to assist. The usually puts dll files in your temp folder, did you run ccleaner to clean out temporary files? I would think CWShredder would find it as well...

Verify these steps, then post a log file as Chaslang requested, one of us will read it. Please ATTACH your log file:

http://forums.majorgeeks.com/showthread.php?t=38752

 

I second that comment MA!

"Ok i tried doing most of the useful things that can remove this toolbar but with no luck."

When we give you steps to perform, we expect them all to be followed. If there are problems along the way, tell us and we will resolve them and continue. Following the procedures quite often resolves problems without additional work. And more often than not, finds additional problems that you did not even know existed.

 

We did not really expect Ccleaner to fix the toolbar problem. We expected it to clean up a load of unnecessary garabage on you PC that sometimes makes problems more difficult to fix.

This statement is extremely foolish:
"I don't have an up-to-date antivirus and not really planning to get one."

With that kind of attitude you will keep getting problems like this back again. There are plenty of free packages you could use. AVG, Avast, AntiVir to name a few. But what is this "Virus Buster" you have running.

You did not post you HJT log as an attachment. What you posted is inline text. Please follow guidelines from now on (I will fix it for you this time).

Make sure you still have System Restore disabled.

Click Start, and then click Run. (The Run dialog box appears.)
Type, or copy and paste, the following text:
regsvr32 /u C:\WINDOWS\EliteBar\EliteBar version 46.dll
then click OK. If a dialog box confirming this action appears, click OK.

RUn HijackThis and put checks on the following lines BUT DO NOT CLICK FIX until you exit all Internet Explorer sessions:
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\EliteBar version 46.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\EliteBar version 46.dll
O4 - HKLM\..\Run: [SysA] C:\windows\system32\winvju32.exe
O9 - Extra button: Corel Network monitor worker - {F5584B21-0326-4259-9488-DD22EF12D1B8} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {F5584B21-0326-4259-9488-DD22EF12D1B8} - (no file)
O9 - Extra button: Corel Network monitor worker - {F5584B21-0326-4259-9488-DD22EF12D1B8} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {F5584B21-0326-4259-9488-DD22EF12D1B8} - (no file) (HKCU)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/c...DC_1_0_0_44.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/117bbbc...ip/RdxIE601.cab

Now make sure you have enabled view of hidden files: http://forums.majorgeeks.com/showthread.php?t=37650
Reboot in safe mode: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam
Locate the below with Windows Explorer and delete them:
C:\WINDOWS\EliteBar <---- delete the whole directory
C:\windows\system32\winvju32.exe

Now reboot in normal mode and let's see how things look.
Let me know if there are any problems completing any of these steps!

 

That error is okay. I did not think that it would except that command due to the spaces in the file name. Just continue and see if you can do the rest with no problems.

Dump the Virusbuster and get one of the free packages I told you about. Try Avast: http://www.majorgeeks.com/download1968.html

 

Your welcome! (Think positive! When you do get rich, come back and build me a baseball field! )

In my first message to you I said, "You should check Add/Remove programs list to see if this has an uninstall."

Now it may not uninstall since we removed those lines using HJT. You can give it a try but it will most likely fail to uninstall using Add/Remove Programs.


If all problems are resolved, enable system restore. You may want to wait to see if we can clean up the EliteBar from Add/Remove programs first.

 

What is it that you downloaded from Panda! All we had indicated in the tutorials was to do the online scan. Did you download the full virus scan package from them and the firewall? Where did you go to get this (give me a link)?

What exactly is happening that is annoying?

I'm surprized that there is no entry in Add/Remove programs? Also I saw no mention of this running in your HijackThis log (other than the active scan .cab file which is only used when you go to their site to do an online scan).


I want to try something for the Elitebar uninstall. Click Start, Run, and then enter regedit into the open box and click okay. Now navigate your way through the registry to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

and see if you can locate Elitebar.

 

There is a whole sequence of questions to answer for the PandaSoftware online scan to begin. Did you get past the point of getting the Security Warning certificate when they download the .cab file to your PC? Did you accept the certificate? It looks like it. I saw this in your log:

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

When that download completes, you can select a variety of scan options and then click the harddisk to scan it. If you are scanning all files including compressed files it can take long time to complete especially if you have a slow internet connection (what do you have? dial-up, cable or dsl?).

 

Can you give me the full path to the registry key (i.e. what comes after the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall )?

READ ALL OF THIS PARAGRAPH BEFORE DOING ANYTHING:
You should be able to just click on it to select it then right click on it to select delete. It would be safer at this point if you first select it and then click File and Export to save the registry key we are going to delete (just in case).

The Panda scan should not still be running. We may have to look at new HJT log and maybe delete the .cab file entry that is in one of the O16 lines.

 

Okay as I indicated below:

READ ALL OF THIS PARAGRAPH BEFORE DOING ANYTHING:
navigate to the point where you have selected

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Elitebar Internet Explorer Toolbar

For the Panda thing, just run HJT and put a check on the below line and click fix:
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

Let me know if that helps.
- then click File and Export to save the registry key we are going to delete (just in case). It will ask you for a file name. Just give it a name like EliteTB. It will add a .reg to it automatically when saved.
- then right click on it and select delete

 

Great! Happy to see we have that Elitear taken care of.

But I'm not sure what you download from Panda but have not been talking about the same thing. Panda online active scan only does something when you connect to their website and request an online scan. It does not doing anything else. So you must have downloaded something else from them.

 

Never saw any problems like that with Avast. Are you sure you do not have multiple virus scan packages installed. It still sounded to me like you installed something from Panda.
You cannot have multiple virus protection applications installed. They typically will cause problems.

What is showing in your Startup list? You can Generate a StartupList log using HijackThis.

Run HJT, select Config on lower right. In the next window first select 'List also minor sections (full)' and then choose 'Generate StartupList log' and save it to a .txt file so you can post it back here as an attachment.

 

Way back in message #7 I asked you to fix the below line with HJT:
O4 - HKLM\..\Run: [SysA] C:\windows\system32\winvju32.exe

and then to delete the file after booting in safe mode (see message #7).

I still see this in your StartUpLog. You need to get rid of that. Also I see some Panda Stuff.
Go to Add/Remove Programs and see if there is anything in there for PandaSoftware. If so, uninstall it.

After doing the above, give me a new HJT log attachment.

 

First I just noticed any spy/keylogger. MyLittleSpy can do the following:

• Log keystrokes
• Log what is copied to the Clipboard
• Run in hidden mode
• Access its menus by pressing Alt+F10

The line indicating this is:
O4 - HKLM\..\Run: [Monitor_Helper] F:\Matthew\Programs\System32\monitor.exe

You need to run Windows Explorer and go to C:\Windows\System32
See if you can find a file named unins000.exe. If so Double-click unins000.exe.

Let me know if you find this and if it runs does it tell you anything.

Some or all of the below may no longer exist if the unins000.exe worked.

Now run HijackThis and have it fix:
O4 - HKLM\..\Run: [Monitor_Helper] F:\Matthew\Programs\System32\monitor.exe

Now click Start, Run, and in the open box enter regedit and click ok!

1. Navigate to the key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
2. In the left plane, delete the subkey (if found):
   
   My Little Spy Trial Version_is1
3. Now navigate to the key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
4. In the right plane, delete the values (if found):
   
   "Win_Code" = ""
   "File_Size" = "20"
   "SystemPriority" = "3"
   "Extended_Clipboard" = "001"
   "Win9xA" = "000"
   "SecureBoot" = "1901503115"
5. Now navigate to the key:
   
   HKEY_CLASSES_ROOT
6. In the left plane, delete the subkey (if found):
   
   Date.Time32
7. Exit the Registry Editor.

Reboot your PC and check to make sure that O4 line is now gone from your HJT log. Also see how things are running. Let me know the results of all this!

Also, I have a question.
Is the version of Download Accelerator Plus (DAP) you are using the free version or did you buy it? The free version is "adware" based!
All of these lines are associated with DAP:
O4 - HKLM\..\Run: [DownloadAccelerator] F:\MATTHEW\PROGRAMS\APPROG~1\DAP.EXE /STARTUP
O8 - Extra context menu item: &Download with &DAP - F:\MATTHEW\PROGRAMS\APPROG~1\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\MATTHEW\PROGRAMS\APPROG~1\dapextie2.htm
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - F:\MATTHEW\PROGRAMS\APPROG~1\DAP.EXE

 

To clean up the Panda Active Scan files (but this really should not be necessary), do the following:

Click Start, and then click Run. (The Run dialog box appears.)
Type, or copy and paste, the following text:
regsvr32 /u C:\WINDOWS\system32\ActiveScan\as.dll
then click OK. If a dialog box confirming this action appears, click OK.

Click Start, and then click Run. (The Run dialog box appears.)
Type, or copy and paste, the following text:
regsvr32 /u C:\WINDOWS\system32\ActiveScan\pavpz.dll
then click OK. If a dialog box confirming this action appears, click OK.

Then use Windows Explore and navigate to C:\WINDOWS\system32\
and delete the whole directory named ActiveScan

This gets rid of the Panda Active Scan files that were downloaded.

 

Get rid of the loading of QuickTime at start up by having HJT fix this:
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

Do you use RealPlayer? If not, why not uninstall it from Add/Remove Programs?

Getting rid of DAP is up to you. If you do not want it, uninstall it using Add/Remove Programs.

Do you use this language translator stuff (I have no idea where you are located or what you need):
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

 

What did you get rid of? Quicktime? RealPlayer?
That was all! Other than DAP!

How are things running now?

 

Yes, I know Real Player and Quicktime are separate things. But both them waste resources. I don't see any need for RealPlayer. I uninstall it from all of my PCs and I have never needed it or missed it. And there is also Real Alternative which is less resource hungry.

There are also probably better alternatives to DAP.

What is your processor speed and how much RAM do you have?

Just keep saving that money! We will get the baseball field someday!

 

More RAM would be good. But I don't think it should be making you PC slow. Unless you are running lots of programs when it is slow. When you said "lil slow and sluggish " what exactly did you mean. What are you doing when you notice this? And how is it different then in the past. Is it only since putting in SP2?

Have you run CWShredder and CoolWWWSearch.SmartKiller (v1/v2) MiniRemoval recently (make sure with CWShredder that you click fix).

I don't use an accelerator. Ask that question in the software forum. In fact, this whole issue may now belong there.

 

I don't use any of those P2P programs, so I not necessarily the right person to ask. Try Emule: http://www.majorgeeks.com/download4302.html . I remember some people saying they liked it. I have no idea. Let me know if it is any good.

I just wanted you to try running those to programs. They clean CWS infections. CWS can be a cause of slow downs. I figure they were worth a try. But you problem may be SP2 (that is not necessarily true. It's just an observation from when you problem may have begun.)

 

If Emule had any form of spyware or ad-ware it would not be on MG's. Ask questions about it in the Software Forum.

I bet the CoolWWWSearch.SmartKiller (v1/v2) MiniRemoval ran. It just gives a very cryptic output that confuses most people. After it runs and does not find anything wrong a window pops up and states:

CoolWWWSearch.SmartKiller (v1/v2) has not been found on your system.

to which you just click okay.

 

Give Emule a try or ask on the software forum about it now before trying. Have you thought about an uninstall of SP2? You may want to discuss your problems and the uninstall of SP2 in the software forum too.

 

Personally, no I have not installed it and I still plan on waiting awhile. You should read thru some of the threads in the software forum. There has been a load of discussion on SP2. There has been some problems and software compatibility issues. I've been too busy to stay on top of it as much as I would like.

Is it an important update? Yes, supposedly. But based upon some of what I have read and heard, I would not do it yet.

 

You are right. The READ ME FIRST link does tell you to go to Windows Update and update. I cannot deny that. I don't know if anyone realized that Microsoft decided to list the WinXP SP2 update as a High Priority (what used to be called critical) update. I do not understand why it would do this to your computer though. I know there has been mention of software compatibility issues. See these:

http://support.microsoft.com/default.aspx?kbid=884130&product=windowsxpsp2
http://bink.nu/files/SP2KBs.htm