How to Remove dddd.exe

[nightowl]

Posted by nyquist thank you!

The [antiware] registry entry is part of Elite Tool Bar.


Please visit my web site for full removal instructions for Elite Toolbar.

http://uk.geocities.com/darren_st/etb/


Removal Instructions appear below:

1. Start the PC in safe mode (hitting F8 key during the startup sequence, then selecting "Safe Mode")

It is important to start the PC in safe mode, otherwise you will not be able to remove the tool bar properly.




2. Remove the following registry entries:

Delete the following keys and all of their contents.

HKLM\SOFTWARE\Elitum\
HKLM\SOFTWARE\Elitum\EliteToolBar\
HKLM\SOFTWARE\Microsoft\DownloadManager\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\EliteBar Internet Explorer Toolbar

Delete the specified values from the following keys (do not delete the entire key).

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run = "C:\WINDOWS\System32\Elite???32.exe"




3. Select "My Computer" in the Registry Editor, then press Ctrl + F to open the Find dialog.

In "Find What" copy and paste the following strings one at a time, searching the entire registry for them. Delete any keys or values that you find.

825CF5BD-8862-4430-B771-0C15C5CA8DEF
28CAEFF3-0F18-4036-B504-51D73BD81ABC
28CAEFF3-0F18-4036-B504-51D73BD81C3A
825CF5BD-8862-4430-B771-0C15C5CA880F
ED103D9F-3070-4580-AB1E-E5C179C1AE41
BE8D0059-D24D-4919-B76F-99F4A2203647




4. If any of the following directory exists, delete it.

C:\WINDOWS\EliteToolBar\*.*
C:\WINDOWS\EliteSideBar\*.*
C:\WINDOWS\EliteBar\*.*
C:\WINDOWS\System32\EliteToolBar\*.*
C:\WINDOWS\System32\EliteSideBar\*.*
C:\WINDOWS\System32\EliteBar\*.*


5. Finally, using the Start Menu Find / Search facilty, search for the following filenames. If any are found deleted them.

- dl
- dl.exe
- suicidetb.exe
- kal*sys.exe
- elite*32.exe
- silent_install.exe
- protection.exe
- protection_update.exe

[nightowl]

Here is how got rid of my elite bar

--------------------------------------------------------------------------------

Well first Thank you Jim (nightowl) for your info and assistance.

I tried a link to an elitebar remover (which was found searching the internet), which did not remove my problem. I did some more research and playing around and Jim (nightowl) gave me the same link again, which I tried earlier, but didn't work.

http://forums.designtechnica.com/showthread.php?t=7010

I ran spy sweeper, spyware doctor, sbybot search, and microsoft antispyware (beta). I then started my computer up into safe mode. Ran the program of ElitetoolbarRemoverV1.0.

I ran through this link's (above) steps (again), but also ran a few other checks myself.

when I had completed the steps, while in registry editor, I ran searches (my computer) of the names on step five (from above link). I also ran the search for "Elitehaf32", "Elite", etc...

I got hits in a couple of spots in which I never got before.

HKCU/software/mircosoft/internetexplorer/explorerbars.{4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} "ContainingtextMRU" "000-005"

HKCU/software/mircosoft/internetexplorer/explorerbars.{4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} "FilesNamedMRU" "000-012"

Under these two sites I found Elitehaf32, dl,dl.exe, suicidetb.exe, kalv, and other variants of the elitetoobar junk. I deleted all the values (not the entire key). I also did not deleat the default value.

I continue to run (under registry editor) a "my computer search" for all of the key names involved with Elitetoolbar. I deleted anything that came up.

I then went back to the start up (menu) search and search my computer files for all the names associated with this elitetoolbar/searchmiracle junk. Deleted anything that came up.

Rebooted and it was FINALLY gone. I have run checks/scans and checked files and it is FINALLY gone.

On a seperate note, not sure if it did anything, but my norton firewall crashed, so i deleted, prior to running all the steps above. Not sure if it a seperate problem or was affected by the elitetoolbar junk. But re-installed
and everything works great.

I hope this can help anyone out there. Please pass it on.

[nightowl]

http://www3.ca.com/securityadvisor/...px?id=453090724

http://forums.majorgeeks.com/showth...?t=54074&page=4

[craab]

Nightowl,
you had helped me last week with the DDDD.exe thing (I may have been the first!)
to no avail. I tried the fix you posted above last night, and it appears to work at first, but as soon as you open a browser, or reconnect to the internet - it ALL comes back.
I have been checking a few other forums, and no one seems to have it fixed - yet.
I am still debating whether to wait a little longer, or reinstall windows.
Anyway, just thought I'd let you know.
-Craab

[hammy]

Again thanks nightowl for the help.

Just wanted to let you know I still don't have any problems for last few days. Been using the internet and no pop up or signs of the elite bar.

Appears that link is close to the solve, just missing a key step.

A step I thought of that I forgot to write in my post, but should be a step anyone should do automatically, after running all the scan and backing out of the safe mode, was to wash the trashcan and remove the cookies and temp files.

[nightowl]

If anyone comes up with anything Post it on this thread. Anything is worth a try.


Please do not post Hijack This Logs on this thread. Only Possible fixes or Ideas

[nyquist]

PROCESSES IN MEMORY

When the PC starts up, some parts of Elite Toolbar load into memory and they are running invisibly in the background whilst you are using your system.

They are actually monitoring the Elite Toolbar installation, and if you try to delete any of the components of Elite Toolbar the processes running in memory will reinstate the ones you have tried to delete.

The same can be said for a great number of spyware, not just Elite Toolbar. So this is really a universal fix.

SAFE MODE WORKAROUND

It's important that before carrying out any form of removal attempt, you start the PC in Safe Mode.

This is done by tapping the F8 key whilst the PC is starting up just after being switched on, then selecting "Safe Mode" from the menu that appears.

When the PC is run in safe mode, it basically runs a very basic version of Windows with a bare minimum number of drivers - just the basics to get Windows started! This means that none of Elite Toobar's processes get loaded up during startup. They get ignored. You are then safe to delete/remove them.

ITTY BITTY PROCESS MANAGER

Another way of stopping components of Elite Toolbar from running in memory is to download the excellent "Itty Bitty Process Manager" from the following location:

http://www.merijn.org/downloads.html

You can use this tool to view all processes currently running in memory, furthermore you can end those processes if they are causing mischief.

Download and run "Itty Bitty Process Manager" on your own PC and kill any processes relating to any of the following file names or anything that looks suspect:

elite???32.exe
kalv???32.exe
shch.exe
msnmsgq32.exe

To do this, select the process in Itty Bitty Process Manager and click "Kill Process".

Once you have killed all the suspect processes you can go ahead with the rest of removal.

STARTUP REGISTRY ENTRIES

Go into the registry editor, and delete any of the following registry entries (if they are present).

These are the registry entries that cause Elite Toolbar to load when the computer starts up.

O4 - HKLM\..\Run: [antiware] C:\windows\system32\elite???32.exe
O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalv???32.exe
O4 - HKLM\..\Run: [msnmsgq32] C:\WINDOWS\msnmsgq.exe
O4 - HKLM\..\Run: [SheduIer] C:\WINDOWS\shch.exe /i


ELITE TOOLBAR FILES

Then delete any of the following folders (if they are present).

C:\Windows\EliteToolbar\
C:\Windows\EliteSidebar\
C:\Windows\System32\EliteToolbar
C:\Windows\System32\EliteSidebar




I hope that you all find the above useful. I'll be updating my web site with more information that I find over this weekend.


http://uk.geocities.com/darren_st/etb/


Nyquist.

[nyquist]

I've been working on an Elite Tool Bar registry fix.

The fix I have made removes all of Elite Tool Bar's registry entries (the ones I know about) from the registry. The latest version of the fix can be downloaded from the following URL. I'll update it as I go along, however at the time of writing I've only tested on a Windows 98 system so not sure if it works yet on Windows XP.

http://uk.geocities.com/darren_st/etb/eliteremove.txt

1. Download the .txt file to your desktop.

2. Rename the file from eliteremove.txt to eliteremove.reg

3. Restart the PC in safe mode.

4. Run the fix by double clicking on the eliteremove.reg file.

You will receive a message "Are you sure you want to add information to the registry".

Click "Yes".

* Removes any reference from Add/Remove programs.
* Removes any reference from Internet Explorer menus.
* Removes the startup hooks.

Updated 20/Feb/2005 @ 20:00 Added removal function for Browser Helper Objects. Rectified some bugs as wasn't removing startup hooks properly.

A brief run down of what is contained within the fix appears below:

-------
REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Elitum]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\DownloadMana ger]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Uninstall\EliteBar Internet Explorer Toolbar]
[-HKEY_CLASSES_ROOT\CLSID\{0A1D22C3-37BE-470C-9C29-E3074EE0574B}]
[-HKEY_CLASSES_ROOT\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}]
[-HKEY_CLASSES_ROOT\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81C3A}]
[-HKEY_CLASSES_ROOT\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA880F}]
[-HKEY_CLASSES_ROOT\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}]
[-HKEY_CLASSES_ROOT\CLSID\{BE8D0059-D24D-4919-B76F-99F4A2203647}]
[-HKEY_CLASSES_ROOT\CLSID\{ED103D9F-3070-4580-AB1E-E5C179C1AE41}]
[-HKEY_CLASSES_ROOT\CLSID\{02C20140-76F8-4763-83D5-B660107BABCD}]
[-HKEY_CLASSES_ROOT\CLSID\{A74CD7DD-EA6F-11D4-ABF3-000102378429}]
[-HKEY_CLASSES_ROOT\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}]
[-HKEY_CLASSES_ROOT\Interface\{276B0903-EB4B-46FF-8304-F093DEF69DE7}]
[-HKEY_CLASSES_ROOT\Interface\{4AFF987A-773B-48E4-AEE8-08EBDDBDADF8}]
[-HKEY_CLASSES_ROOT\Interface\{CAAB3B3F-E815-47D9-94FD-8BB9143C0077}]
[-HKEY_CLASSES_ROOT\Interface\{ED646219-20BF-41E5-80FD-EE49021DA599}]
[-HKEY_CLASSES_ROOT\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}]
[-HKEY_CLASSES_ROOT\TypeLib\{8AA59E15-6E81-415C-B299-1ADFB50C8E1A}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{28CAEFF 3-0F18-4036-B504-51D73BD81ABC}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{825CF5B D-8862-4430-B771-0C15C5CA8DEF}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{BE8D005 9-D24D-4919-B76F-99F4A2203647}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{ED103D9 F-3070-4580-AB1E-E5C179C1AE41}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{0A1D22C 3-37BE-470C-9C29-E3074EE0574B}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{825CF5B D-8862-4430-B771-0C15C5CA880F}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{28CAEFF 3-0F18-4036-B504-51D73BD81C3A}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\Interface\{A9B 28EF6-ABF3-463B-A3D8-4D0D0BADFADC}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\TypeLib\{CA9FC 31A-6F35-4493-B629-E64BD6170A17}\1.0]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{BE8D0059-D24D-4919-B76F-99F4A2203647}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{ED103D9F-3070-4580-AB1E-E5C179C1AE41}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{0A1D22C3-37BE-470C-9C29-E3074EE0574B}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{825CF5BD-8862-4430-B771-0C15C5CA880F}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81C3A}]
[-HKEY_CURRENT_USER\Software\LQ]
[-HKEY_CLASSES_ROOT\CGBand.BHO]
[-HKEY_CLASSES_ROOT\CGBand.BHO.1]
[-HKEY_CLASSES_ROOT\CGBand.UICGBandObj]
[-HKEY_CLASSES_ROOT\CGBand.UICGBandObj.1]
[-HKEY_CLASSES_ROOT\CGBand.CGBandObj]
[-HKEY_CLASSES_ROOT\CGBand.CGBandObj.1]
[-HKEY_CLASSES_ROOT\PLOT.PlotCtrl.1]
.
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]
"antiware"=-
.
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]
"kalvsys"=-
.
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]
"msnmsgq32"=-
.
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]
"SheduIer"=-
.
------

[nyquist]

I have now created an Elite Tool Bar removal batch file.

Download the latest version of the file from:

http://uk.geocities.com/darren_st/etb/eliteremover.txt

1. Save the file to your desktop.

2. Rename the file from eliteremover.txt to eliteremover.bat

3. Restart your PC in safe mode (very important).

4. Double click on eliteremover.bat

5. Restart your PC in normal mode.

6. Elite Tool Bar should be removed.



The batch file does the following:

* Removes Elite Tool Bar files.
* Removes Elite Tool Bar folders.
* Removes Elite Tool Bar registry entries.



-------
CLS
CLS
ECHO OFF
ECHO Elite Toolbar Removal Batch File
ECHO Created by Nyquist on 19th Feb 2005.
ECHO OFF
ECHO Removing Elite Tool Bar directories.
ECHO Searching %windir%
IF EXIST %windir%\elitetoolbar\nul DELTREE /y %windir%\elitetoolbar
IF EXIST %windir%\elitesidebar\nul DELTREE /y %windir%\elitesidebar
ECHO Searching %temp%
IF EXIST %temp%\elitetoolbar\nul DELTREE /y %temp%\elitetoolbar
IF EXIST %temp%\elitesidebar\nul DELTREE /y %temp%\elitesidebar
ECHO Searching %windir%\SYSTEM
IF EXIST %windir%\SYSTEM\elitetoolbar\nul DELTREE /y %windir%\SYSTEM\elitetoolbar
IF EXIST %windir%\SYSTEM\elitesidebar\nul DELTREE /y %windir%\SYSTEM\elitesidebar
ECHO Searching %windir%\SYSTEM32
IF EXIST %windir%\SYSTEM32\elitetoolbar\nul DELTREE /y %windir%\SYSTEM32\elitetoolbar
IF EXIST %windir%\SYSTEM32\elitesidebar\nul DELTREE /y %windir%\SYSTEM32\elitesidebar
ECHO Removing Elite Tool Bar files.
ECHO Searching %windir%
IF EXIST %windir%\eliteerror.dat DEL %windir%\eliteerror.dat
IF EXIST %windir%\eliteerror32.dat DEL %windir%\eliteerror32.dat
IF EXIST %windir%\system\elitedoolsav.dat DEL %windir%\system\elitedoolsav.dat
IF EXIST %windir%\system\eliteerror.dat DEL %windir%\system\eliteerror.dat
IF EXIST %windir%\system\eliteerror32.dat DEL %windir%\system\eliteerror32.dat
IF EXIST %windir%\system32\eliteerror.dat DEL %windir%\system32\eliteerror.dat
IF EXIST %windir%\system32\eliteerror32.dat DEL %windir%\system32\eliteerror32.dat
ECHO Removing startup hooks.
IF EXIST %temp%\suicidetb.exe DEL %temp%\suicidetb.exe
IF EXIST %windir%\system\elite*.exe DEL %windir%\system\elite*.exe
IF EXIST %windir%\system\kalv*.exe DEL %windir%\system\kalv*.exe
IF EXIST %windir%\system\msnmsgq32*.exe DEL %windir%\system\msnmsgq32.exe
IF EXIST %windir%\system\shch.exe DEL %windir%\system\shch.exe
ECHO Creating temporary .reg file.
> "%Temp%.\eliteremove.reg" ECHO REGEDIT4
>>"%Temp%.\eliteremove.reg" ECHO.
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Elitum]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\DownloadMana ger]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Uninstall\EliteBar Internet Explorer Toolbar]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CLSID\{0A1D22C3-37BE-470C-9C29-E3074EE0574B}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81C3A}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA880F}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CLSID\{BE8D0059-D24D-4919-B76F-99F4A2203647}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CLSID\{ED103D9F-3070-4580-AB1E-E5C179C1AE41}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CLSID\{02C20140-76F8-4763-83D5-B660107BABCD}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CLSID\{A74CD7DD-EA6F-11D4-ABF3-000102378429}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\Interface\{276B0903-EB4B-46FF-8304-F093DEF69DE7}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\Interface\{4AFF987A-773B-48E4-AEE8-08EBDDBDADF8}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\Interface\{CAAB3B3F-E815-47D9-94FD-8BB9143C0077}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\Interface\{ED646219-20BF-41E5-80FD-EE49021DA599}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\TypeLib\{8AA59E15-6E81-415C-B299-1ADFB50C8E1A}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{28CAEFF 3-0F18-4036-B504-51D73BD81ABC}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{825CF5B D-8862-4430-B771-0C15C5CA8DEF}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{BE8D005 9-D24D-4919-B76F-99F4A2203647}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{ED103D9 F-3070-4580-AB1E-E5C179C1AE41}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{0A1D22C 3-37BE-470C-9C29-E3074EE0574B}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{825CF5B D-8862-4430-B771-0C15C5CA880F}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{28CAEFF 3-0F18-4036-B504-51D73BD81C3A}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\CLASSES\Interface\{A9B 28EF6-ABF3-463B-A3D8-4D0D0BADFADC}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\CLASSES\TypeLib\{CA9FC 31A-6F35-4493-B629-E64BD6170A17}\1.0]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{BE8D0059-D24D-4919-B76F-99F4A2203647}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{ED103D9F-3070-4580-AB1E-E5C179C1AE41}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{0A1D22C3-37BE-470C-9C29-E3074EE0574B}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{825CF5BD-8862-4430-B771-0C15C5CA880F}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81C3A}]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CURRENT_USER\Software\LQ]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CGBand.BHO]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CGBand.BHO.1]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CGBand.UICGBandObj]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CGBand.UICGBandObj.1]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CGBand.CGBandObj]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\CGBand.CGBandObj.1]
>>"%Temp%.\eliteremove.reg" ECHO [-HKEY_CLASSES_ROOT\PLOT.PlotCtrl.1]
>>"%Temp%.\eliteremove.reg" ECHO .
>>"%Temp%.\eliteremove.reg" ECHO [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]
>>"%Temp%.\eliteremove.reg" ECHO "antiware"=-
>>"%Temp%.\eliteremove.reg" ECHO .
>>"%Temp%.\eliteremove.reg" ECHO [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]
>>"%Temp%.\eliteremove.reg" ECHO "kalvsys"=-
>>"%Temp%.\eliteremove.reg" ECHO .
>>"%Temp%.\eliteremove.reg" ECHO [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]
>>"%Temp%.\eliteremove.reg" ECHO "msnmsgq32"=-
>>"%Temp%.\eliteremove.reg" ECHO .
>>"%Temp%.\eliteremove.reg" ECHO [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]
>>"%Temp%.\eliteremove.reg" ECHO "SheduIer"=-
>>"%Temp%.\eliteremove.reg" ECHO .
ECHO Removing Elite Tool Bar registry entries.
START /WAIT REGEDIT /S "%Temp%.\eliteremove.reg"
ECHO Deleting temporary .reg file.
DEL "%Temp%.\eliteremove.reg"
ECHO Finished. Now reboot the computer.
-------

[nyquist]

Elite Tool Bar Remover version 1.1 has just been released. It contains all the functionality of the above batch file, so give it a try. You can download this freeware utility from:

http://www.simplytech.it/ETRemover/

[nightowl]

These websites May be helpful.


related to sysmonnt.exe

http://www.greatis.com/appdata/d/m/msnavc32.exe_Removal.htm

dddd.exe

http://vil.nai.com/vil/content/v_132205.htm


This is The Last Post in this thread. If you wish to post a log. Please start a new thread and post your log in the Log Section, thanks. Here is the link.

http://forums.designtechnica.com/forumdisplay.php?f=127

Also If you have any useful suggestions on this topic send a Private Message to nightowl or ECA and we can reopen the thread for you