What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Here Are My Log Files

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm infected with EliteBar, and tried 4 other tools to remove it, it keeps coming back each time I start my computer.

I followed the instructions of Hijack This. Here is my result. I saw the elitebar files (02, 03) but wondered if there are any more that should be fixed.

Bye,
Susanne



Logfile of HijackThis v1.98.2
Scan saved at 18:20:45, on 27.08.2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\MXTask.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\WINDOWS\Explorer.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe
C:\WINDOWS\System32\internat.exe
C:\Programme\Netscape\Netscape\Netscp.exe
C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
C:\WINDOWS\winhlp32.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freemail.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R3 - Default URLSearchHook is missing
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\ELITEB~1.DLL (file missing)
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL (file missing)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\Ontrack\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SysA] C:\windows\system32\wingjv32.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Programme\Netscape\Netscape\Netscp.exe" -turbo
O4 - Global Startup: CAPIControl.lnk = C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
O4 - Global Startup: HomeNet Control.lnk = C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O15 - Trusted Zone: *.vladzone.com
O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200211…meInstaller.exe
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/de/big/1.1….g/GoogleNav.cab
Post #3
Hm, I read some other posts here, and it seems those searchmiracle files are no good as well. I know, it is still early in the USA, here in Europe it's already evening, I just hope I don't have to wait till the morning :unsure: Susanne
Post #4
Hello Susanne,

Close all Browser and Program Windows and have HijackThis fix the following by checking the box beside each and then clicking on Fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R3 - Default URLSearchHook is missing
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\ELITEB~1.DLL (file missing)
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL (file missing)

The following activeX controls will reinstall when(and if) you revisit that website, UNLESS you know they are from a safe source, check to remove.
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200211…meInstaller.exe

Then Download System Security Suite. Extract it from the zip file into a folder.
http://www.igorshpak.net/software/3ssetup104.zip
Under "items to clear" click all. Then click "clear selected items"

Reboot and Rescan with HJT and post a new log here.
Also please describe how your computer behaves at the moment.


C:\windows\system32\wingjv32.exe Can you follow the path and right click on wingjv32.exe and check the properties and post the information.
Post #5
Hi Little Eagle,

I did what you said and I'm :rant2: because those files keep coming back after restart.

At the moment my computer is not behaving bad, but he (she?) did yesterday. I didn't even have access to the internet, couldn't open word.doc files properly etc.

Is the file in my first post (16) with searchmiracle in it, safe?

And I'm sorry, but I didn't understand what you meant with your green posting. Shall I remove it? Thanks!

Here is my new logfile:

Logfile of HijackThis v1.98.2
Scan saved at 21:09:46, on 27.08.2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\MXTask.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\WINDOWS\Explorer.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe
C:\WINDOWS\System32\internat.exe
C:\Programme\Netscape\Netscape\Netscp.exe
C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freemail.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\Ontrack\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SysA] C:\windows\system32\wingjv32.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Programme\Netscape\Netscape\Netscp.exe" -turbo
O4 - Global Startup: CAPIControl.lnk = C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
O4 - Global Startup: HomeNet Control.lnk = C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O15 - Trusted Zone: *.vladzone.com
O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200211…meInstaller.exe
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/de/big/1.1….g/GoogleNav.cab
Post #6
And before I forget it, I couldn't follow the path. I do have System32 but didn't find wingjv32.exe I hope I didn't delete to much. Susanne
Post #7 last edited
Reboot in SAFE MODE If you don't know how click here

Browser and Program Windows and have HijackThis fix the following by checking the box beside each and then clicking on Fix checked.

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O15 - Trusted Zone: *.vladzone.com
O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200211…meInstaller.exe

Delete the following files and folder listed
C:\WINDOWS\EliteBar

Reboot

Go here and run online scans (all), allow them to delete whatever they find:

eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done. Rescan with HJT and post a new log here.

Is the file in my first post (16) with searchmiracle in it, safe?

And I'm sorry, but I didn't understand what you meant with your green posting. Shall I remove it? Thanks!



1. No
2. yes
Post #8


eTrust AntiVirus Web Scanner

- Found 1 Virus = deleted

Panda ActiveScan

- Found 2 Viruses = deleted

- If you need to know which viruses they were, I can post it.

Hey little eagle,

I did everything you asked me to. It took a while till everything was scanned. Unfortunatly with no success. See yourself:

Logfile of HijackThis v1.98.2
Scan saved at 23:08:02, on 27.08.2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\MXTask.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\WINDOWS\Explorer.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe
C:\WINDOWS\System32\internat.exe
C:\Programme\Netscape\Netscape\Netscp.exe
C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freemail.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\Ontrack\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SysA] C:\windows\system32\wingjv32.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Programme\Netscape\Netscape\Netscp.exe" -turbo
O4 - Global Startup: CAPIControl.lnk = C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
O4 - Global Startup: HomeNet Control.lnk = C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/de/big/1.1….g/GoogleNav.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -

http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -

http://www.pandasoftware.com/activescan/as5/asinst.cab
Post #9
Okay, I'm afraid, your already gone to sleep. So just in case I mail the virus info found. msxmidi.exe = WIN32.WINSHOW.E and Incident Status Location Virus:Trj/Downloader.PF Disinfected C:\WINDOWS\Downloaded Program Files\v2.dll Virus:Trj/Downloader.GY Disinfected C:\WINDOWS\SYSTEM32\notepad.com Also, what I wanted to say, I already tried SAFE MODE this morning and deleted WINDOWS/ELITEBAR but it came back Is it possible, that the version of Elitebar is so new that no program detects it? I thought about installing my whole system new to get rid of it. Although I don't like to think about it!! <_< Another question: I have the System Suite installed that should protect me, but (shame on me) I didn't update it for …. 3 years. I know, don't beat me. :wtf: What do you think, is the program good enough to give it an update? I must say, that I don't like to work with that program for handling reasons. :huh: It's midnight here, I still wait a little bit if someone has some other suggestions or answers, and go to bed then. Susanne
Post #10
Using my time, I let Spybot and Adaware run again. I let them do the check yesterday, already. AND STILL THEY FOUND SOMETHING. I'm shocked. There is no safety out there. Anyway, they didn't catch my no. 1 enemy: elitebar But I'm not giving up. See you tomorrow. :ph34r: Good night Susanne
Post #11
Start Sypbot click "mode" "advanced" "tools" "system startup"
Then uncheck [SysA] C:\windows\system32\wingjv32.exe

Reboot Then have HijackThis fix,

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL

Another question: I have the System Suite installed that should protect me, but (shame on me) I didn't update it for …. 3 years. I know, don't beat me. confused.gif What do you think, is the program good enough to give it an update? I must say, that I don't like to work with that program for handling reasons. huh.gif


Instructions for another way.
http://www.cybertechhelp.com/html/tutorial…orial.php/id/31
Post #12
I hope I did undertand you right, you didn't wanted me to delete the wingjv32.exe file, just take of the green mark and thats it.

This didn't help either. Here is my Log file

Logfile of HijackThis v1.98.2
Scan saved at 17:34:15, on 28.08.2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\MXTask.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\WINDOWS\Explorer.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe
C:\WINDOWS\System32\internat.exe
C:\Programme\Netscape\Netscape\Netscp.exe
C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freemail.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\Ontrack\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SysA] C:\windows\system32\wingjv32.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Programme\Netscape\Netscape\Netscp.exe" -turbo
O4 - Global Startup: CAPIControl.lnk = C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
O4 - Global Startup: HomeNet Control.lnk = C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/de/big/1.1….g/GoogleNav.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab



Last night I updated my System Suite but that didn't help either.

After posting this I will see whats behind your link.

Susanne
Post #13
My temporary files are deleted now. What I also did, was after I let HijackThis fix the elitebar files, was rebooting. Was I to quick? Susanne :wtf:
Post #14

I hope I did undertand you right, you didn't wanted me to delete the wingjv32.exe file, just take of the green mark and thats it.

That disables it. So yes if you find you need it. You can restore it.


What I also did, was after I let HijackThis fix the elitebar files, was rebooting. Was I to quick?


No you did it right. I'll see if somebody can that a look and see why

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81C3A} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL

wont delete check back latter
Post #15
Hi little eagle, is it okay when this file still shows up, even when I disabled it? O4 - HKLM\..\Run: [SysA] C:\windows\system32\wingjv32.exe Susanne

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI