Elitebar, elitum elite bar, exact advertising, etc.

ko0pa · 12-14-2004, 11:41 PM

Wow I've never had this problem. No matter what I can't get rid of this. I've ran adaware, spybot S&D, spyware doctor etc etc etc. I've done it in safemode I've tryed everything. HelP

Logfile of HijackThis v1.98.2
Scan saved at 11:39:19 PM, on 12/14/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\srxTitan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
L:\LiteStep\litestep.exe
L:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows ControlAd\WinCtlAd.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
L:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\wuauclt.exe
L:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
L:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.657\Hi jackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll
O4 - HKLM\..\Run: [Zone Labs Client] "L:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\Run: [kalvsys] c:\windows\system32\kalvotd32.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKCU\..\Run: [Spyware Doctor] "L:\Program Files\Spyware Doctor\swdoctor.exe" /Q

intercodes · 12-15-2004, 09:15 AM

ko0pa,

Fix these,

C:\Program Files\Windows ControlAd\WinCtlAd.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/

O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll

O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe

Fix them and post your log.

southernlady · 12-15-2004, 02:12 PM

Please WAIT...there is a certain WAY to fix this log. Liz

southernlady · 12-15-2004, 03:21 PM

First, you are running Hijack This out of a temporary directory on your desktop. Can you please create a folder in My Documents and call it Hijack (or something similar). Then extract Hijack This into the folder you have created and run it from there. The reason for this is that Hijack This backup files may be deleted if it is being run from a temporary folder.

Turn off System Restore: System Restore

Next,you need to download CWShredder. Here's where you can get it: CWShredder

Then, restart into Safe Mode (tap F8 while restarting), and make sure you can see hidden files and folders. Here's a link on how to do this: Safe Mode: Safe Mode Show Hidden Files: Show Hidden Files

Run CWShredder and click Fix ->.

Run Hijackthis! and fix the following:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php

O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll

O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe

O4 - HKLM\..\Run: [kalvsys] c:\windows\system32\kalvotd32.exe

Then, find and delete:

C:\WINDOWS\system32\srxTitan.exe

L:\LiteStep\litestep.exe

C:\Program Files\Windows ControlAd\WinCtlAd.exe

C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe

Go ahead and clear out your temp files, as well. Delete everything inside these folders:

C:\Windows\Temp\what is inside

C:\Windows\Temporary Internet Files\what is inside

C:\Windows\Cookies\what is inside

Reboot

Empty your recycle bin

Post a new log

Liz

ko0pa · 12-15-2004, 03:28 PM

I'm going to do it now and ill have the log up within 10 minutes

thanks guys!

southernlady · 12-15-2004, 03:30 PM

Did you see my edit? Liz

ko0pa · 12-15-2004, 04:19 PM

yes I went straight to yours. here's the new list.. popups still coming. Also cwssheder didnt do anything :/ There was nothing to fix it said

Logfile of HijackThis v1.98.2
Scan saved at 4:18:28 PM, on 12/15/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\Ati2evxx.exe
L:\LiteStep\litestep.exe
L:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
L:\Program Files\Razer\razertra.exe
L:\Program Files\Spyware Doctor\swdoctor.exe
L:\Program Files\Razer\razerhid.exe
C:\Program Files\Common Files\Symantec Shared\Nmain.exe
C:\WINDOWS\system32\wuauclt.exe
L:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Administrator\My Documents\hijack\HijackThis.exe

O4 - HKLM\..\Run: [Zone Labs Client] "L:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [kalvsys] c:\windows\system32\kalvotd32.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [razertra] L:\Program Files\Razer\razertra.exe
O4 - HKCU\..\Run: [Spyware Doctor] "L:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: enable tray icon.lnk = ?
O4 - Startup: Norton SystemWorks.lnk = ?

ko0pa · 12-15-2004, 04:21 PM

Also L:\litestep\litestep.exe is not a problem. It's my shell so ignore that.

southernlady · 12-15-2004, 04:26 PM

That's why I put Litestep on the list:

http://forums.techguy.org/t218333.html

http://forums.techguy.org/t223085.html

ko0pa · 12-15-2004, 04:42 PM

it's not going to screw up anything if i remove the boot for litestep? that thread just kinda left you hanging... and this will fix the popups?

12-14-2004, 11:41 PM	#1 (permalink)
ko0pa Newb Techie Join Date: Aug 2004 Posts: 26	Elitebar, elitum elite bar, exact advertising, etc. Wow I've never had this problem. No matter what I can't get rid of this. I've ran adaware, spybot S&D, spyware doctor etc etc etc. I've done it in safemode I've tryed everything. HelP Logfile of HijackThis v1.98.2 Scan saved at 11:39:19 PM, on 12/14/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE C:\WINDOWS\system32\srxTitan.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\system32\Ati2evxx.exe L:\LiteStep\litestep.exe L:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Windows ControlAd\WinCtlAd.exe C:\WINDOWS\system32\ezSP_Px.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe L:\Program Files\Spyware Doctor\swdoctor.exe C:\WINDOWS\system32\wuauclt.exe L:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\explorer.exe L:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.657\Hi jackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll O4 - HKLM\..\Run: [Zone Labs Client] "L:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe O4 - HKLM\..\Run: [kalvsys] c:\windows\system32\kalvotd32.exe O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup O4 - HKCU\..\Run: [Spyware Doctor] "L:\Program Files\Spyware Doctor\swdoctor.exe" /Q

12-15-2004, 02:12 PM	#3 (permalink)
southernlady Monster Techie Join Date: Nov 2004 Posts: 1,346	Please WAIT...there is a certain WAY to fix this log. Liz __________________ Priority Computers \| AdAware SE \| SpyBot-Search & Destroy \| SpywareBlaster \| SpywareGuard \| HijackThis \| Stealing is illegal Powered by Emily!

12-15-2004, 03:21 PM	#4 (permalink)
southernlady Monster Techie Join Date: Nov 2004 Posts: 1,346	First, you are running Hijack This out of a temporary directory on your desktop. Can you please create a folder in My Documents and call it Hijack (or something similar). Then extract Hijack This into the folder you have created and run it from there. The reason for this is that Hijack This backup files may be deleted if it is being run from a temporary folder. Turn off System Restore: System Restore Next,you need to download CWShredder. Here's where you can get it: CWShredder Then, restart into Safe Mode (tap F8 while restarting), and make sure you can see hidden files and folders. Here's a link on how to do this: Safe Mode: Safe Mode Show Hidden Files: Show Hidden Files Run CWShredder and click Fix ->. Run Hijackthis! and fix the following: R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe O4 - HKLM\..\Run: [kalvsys] c:\windows\system32\kalvotd32.exe Then, find and delete: C:\WINDOWS\system32\srxTitan.exe L:\LiteStep\litestep.exe C:\Program Files\Windows ControlAd\WinCtlAd.exe C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe Go ahead and clear out your temp files, as well. Delete everything inside these folders: C:\Windows\Temp\what is inside C:\Windows\Temporary Internet Files\what is inside C:\Windows\Cookies\what is inside Reboot Empty your recycle bin Post a new log Liz __________________ Priority Computers \| AdAware SE \| SpyBot-Search & Destroy \| SpywareBlaster \| SpywareGuard \| HijackThis \| Stealing is illegal Powered by Emily!

12-15-2004, 03:30 PM	#6 (permalink)
southernlady Monster Techie Join Date: Nov 2004 Posts: 1,346	Did you see my edit? Liz __________________ Priority Computers \| AdAware SE \| SpyBot-Search & Destroy \| SpywareBlaster \| SpywareGuard \| HijackThis \| Stealing is illegal Powered by Emily!

12-15-2004, 04:26 PM	#9 (permalink)
southernlady Monster Techie Join Date: Nov 2004 Posts: 1,346	That's why I put Litestep on the list: http://forums.techguy.org/t218333.html http://forums.techguy.org/t223085.html __________________ Priority Computers \| AdAware SE \| SpyBot-Search & Destroy \| SpywareBlaster \| SpywareGuard \| HijackThis \| Stealing is illegal Powered by Emily!

12-15-2004, 09:15 AM	#2 (permalink)
intercodes Ultra Techie Join Date: Jun 2004 Posts: 973	ko0pa, Fix these, C:\Program Files\Windows ControlAd\WinCtlAd.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/ O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe Fix them and post your log.

12-15-2004, 03:28 PM	#5 (permalink)
ko0pa Newb Techie Join Date: Aug 2004 Posts: 26	I'm going to do it now and ill have the log up within 10 minutes thanks guys!

12-15-2004, 04:19 PM	#7 (permalink)
ko0pa Newb Techie Join Date: Aug 2004 Posts: 26	yes I went straight to yours. here's the new list.. popups still coming. Also cwssheder didnt do anything :/ There was nothing to fix it said Logfile of HijackThis v1.98.2 Scan saved at 4:18:28 PM, on 12/15/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe C:\WINDOWS\system32\Ati2evxx.exe L:\LiteStep\litestep.exe L:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ezSP_Px.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe L:\Program Files\Razer\razertra.exe L:\Program Files\Spyware Doctor\swdoctor.exe L:\Program Files\Razer\razerhid.exe C:\Program Files\Common Files\Symantec Shared\Nmain.exe C:\WINDOWS\system32\wuauclt.exe L:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Administrator\My Documents\hijack\HijackThis.exe O4 - HKLM\..\Run: [Zone Labs Client] "L:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [kalvsys] c:\windows\system32\kalvotd32.exe O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup O4 - HKLM\..\Run: [razertra] L:\Program Files\Razer\razertra.exe O4 - HKCU\..\Run: [Spyware Doctor] "L:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Startup: enable tray icon.lnk = ? O4 - Startup: Norton SystemWorks.lnk = ?

12-15-2004, 04:21 PM	#8 (permalink)
ko0pa Newb Techie Join Date: Aug 2004 Posts: 26	Also L:\litestep\litestep.exe is not a problem. It's my shell so ignore that.

12-15-2004, 04:42 PM	#10 (permalink)
ko0pa Newb Techie Join Date: Aug 2004 Posts: 26	it's not going to screw up anything if i remove the boot for litestep? that thread just kinda left you hanging... and this will fix the popups?

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode