What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Here Are My Log Files

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Download Registrar Lite from here

Put it in its own folder. You may want to keep this program. It is an excellent free, registry editor.
Copy and paste the follow text into the address bar, then hit 'Go':
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar

In the pane on the right are the values associated with that key.
We want to remove this one -> {825CF5BD-8862-4430-B771-0C15C5CA880F}

Right click on it, and select delete.
If you get a confirmation question, respond OK then close out the program.

Then start up spybot and go to 'tools' " BHO's" click
{28CAEFF3-0F18-4036-B504-51D73BD81C3A}
then remove.

Close program reboot and post another log.
Post #17
Hi little eagle,

I did everything and here is my log file. This thing is a real pain in the neck :angry:

Logfile of HijackThis v1.98.2
Scan saved at 11:20:50, on 29.08.2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\MXTask.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\WINDOWS\Explorer.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe
C:\WINDOWS\System32\internat.exe
C:\Programme\Netscape\Netscape\Netscp.exe
C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freemail.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\Ontrack\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programme\Roxio\WinOnCD 6 PE\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SysA] C:\windows\system32\wingjv32.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Programme\Netscape\Netscape\Netscp.exe" -turbo
O4 - Global Startup: CAPIControl.lnk = C:\Programme\Telekom\Eumex 704PC DSL\Capictrl.exe
O4 - Global Startup: HomeNet Control.lnk = C:\Programme\Telekom\Eumex 704PC DSL\HNetCtrl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/de/big/1.1….g/GoogleNav.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
Post #18
I checked with Registrar Lite again. Now the file you wanted me to delete is gone from there, it didn't come back (so why does it come back in my log files?!?!). Those are the files still in there. Strange signs are the icons where it says Data. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383} HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} Susanne
Post #19
Hello little eagle, I have a question concerning Netscape. I do get orders from my online shop and people mostly pay with Creditcards. I always used Netscape to charge the cc online. On Friday I called my bank to tell them to stop the program for me till I get this problem fixed. Do you think Netscape is safe for the elitebar problem, so that I can go on working? Thanks Susanne
Post #20
I now installed Mozilla Firefox 0.9.3 (lates update in German Language) and hope to be a little safer. I'm not going to use I.E. again. Susanne
Post #21

I now installed Mozilla Firefox 0.9.3 (lates update in German Language) and hope to be a little safer. I'm not going to use I.E. again.


You'll have to to update windows. But that is all I use it for.

Check you PM's
Post #23 last edited

Hello littleeagle,

did you get my e-mail? Or is this your day off today? I'm sure you deserved it.

Susanne :wavey:

Got it I don't get days off, I do this for fun and to get back at hackers.
That screwed up my PC :D


Reboot in SAFE MODE.
Close all Browser and Program Windows and have HijackThis fix the following by checking the box beside each and then clicking on Fix checked.

O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA880F} - C:\WINDOWS\EliteBar\ELITEB~1.DLL
O4 - HKLM\..\Run: [SysA] C:\windows\system32\wingjv32.exe

Find and delete

C:\WINDOWS\EliteBar<<< C:\windows\system32\wingjv32.exe << C:\Windows\System32\bkmsf32.dat<< ^^^This is the bugger that we were looking for.

Thanks for the files, and thanks to Daemon Hope you get your PC working.

Then run System Security Suite. Extract it from the zip file into a folder.
http://www.igorshpak.net/software/3ssetup104.zip
Under "items to clear" click all. Then click "clear selected items"


:wavey: Hope everythings working Fine after this.
Post #26
Again thank you little eagle and the whole Tom Coyote Team. It's so great that you're here!!! I donated some money via Paypal. I hope you can keep up this page forever! A huge THANK YOU and a BIG HUG Susanne :D
Post #27
Sorry forgot about this one

HKEY_CURRENT_USER\Software\LQ <– it adds this key


You can use Registrar Lite to get rid of it or just
regedit if they are comfortable working with the registry.
The entire LQ key should be deleted.
It contains location data about you or rather about your ISP.
Unlikely to be an issue without the rest of the associated cr@p
but clutters up the registry all the same.

Thanks again Daemon.

Is there anything I can do for you???

I donated some money via Paypal.


Thanks thats enough ;)
Post #30
Glad we could help :D



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI