Here is how you can manually remove SearchMiracle.EliteBar
Ripped from this forum:
http://www.mytechsupport.ca/support/topic.asp?TOPIC_ID=6533
Set Windows to show Hidden files and folders
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and
folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.
**(Always create a Folder for HiJackThis anywhere but your Temp/Temporary
Internet Folders. This is where it will save the backup files needed if
there's a problem.)**
Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following:
(They may or may not be there)
system.exe
kalvpye32.exe
ssvpcwe.exe
mnyexpr.exe
Turn off System Restore WinXP WinME. (Turn it back on after this is repaired
and you've rebooted.) Close all other open Windows and have HiJackThis Fix:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [system manager] system.exe
O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvpye32.exe
O4 - HKLM\..\Run: [unkD] C:\WINDOWS\ssvpcwe.exe
O4 - HKLM\..\Run: [deGFd9FJ0] C:\WINDOWS\ssvpcwe.exe
O4 - HKLM\..\RunServices: [system manager] system.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft
Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [system manager] system.exe
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} -
C:\Program Files\Microsoft Money\System\mnyside.dll
The next are optional, but recommended for removal,Resource hogs and not
needed on startup, but does not disable the program:
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
Go to Control Panel / Add/Remove Programs and remove the
following if they are there:
SearchMiracle
Now delete these Folders or Files that are Highlighted: (You may need enable
"Show all Files" and disable "Hide System Files" in Windows Explorer / Tools
/ Folder Options / View Tab) (You may have to boot to "Safe Mode" in order
to delete some Files/Folders)
C:\windows\system32\kalvpye32.exe
C:\WINDOWS\ssvpcwe.exe
Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary
Internet Files Folder and then empty your "Recycle Bin" and Reboot.
In Xp, here are some locations of Temp files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet
Files
C:\Documents and Settings\Username\Local Settings\Temporary Internet Files
C:\Documents and Settings\Default User\Local Settings\Temporary Internet
Files
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet
Files
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet
Files
Turn on System restore,before opening your browser goto START>CONTROL
PANEL>INTERNET OPTIONSand make sure your Homepage is correct,if not ,type
the URL you would like in the HomePage box.
Now re-run HJT and post a new logfile back here.
