Monday, October 17, 2005

Elite Toolbar Remover Information Page

The information in Virtual Grub Street's computer postings is the result of thousands of web searches. It can not, however, possibly be complete. The subject is vast and constantly changing. Moreover, vendor uninstall tools and other freeware removal tools do not necessarily remove all of an infection from your computer. Vendor uninstall tools, for instance, may silently leave cookies or other tracking software installed. It is suggestible to follow up a removal with one or more adware scans and/or to do an inspection using a HijackThis log. The information on the page is not guaranteed correct and any use you may choose to make of it is entirely at your own risk.


*

Intro: The Elite Toolbar Remover was created by an Italian male named Gian Carlo Calo who is very careful to keep his personal information off of the web. Calo would seem to be one of several Italians who have formed the company Simply Tech. The company offers the freeware Elite Toolbar Remover as well as freeware encryption programs. Paypal donations are requested on a discrete location at the bottom of the page.

Latest Version. SimplyTech's new Elite Toolbar Remover has just announced another update (to Version 2.1.2) that removes SearchMiracle.EliteBar [a.k.a. YupSearch (see YupSearch Addendum), Elite Toolbar, Elitum, ETBrun, LQ, etc.] even without putting the computer in Safe Mode.

vs. PokaPoka. The site JayLoden.com, however, recently reports (Oct 14, 2005 01:20AM) that the tool is presently unable to remove variants of PokaPoka above pokapoka75:

"There is a new version of the ETRemover from SimplyTech out, so if you're experiencing problems with EliteBar and/or PokaPoka I suggest you try that. I gave it a go on the most current pokapoka variant I could get (pokapoka76) and it didn't remove it at the time of writing. However, I will be sending the author of ETRemover a dump file of pokapoka76.exe and hopefully he will be able to update ETRemover."

vs. EliteBar.d. As VGS reported, on May 22, the Elite Toolbar Remover can not remove adw_elitebar.d. This variant utilizes entirely random files names. The variant is not common.

Removes other malware. Calo claims that the tool can remove the following other infections, as well: EliteBar; EliteToolbar; EliteSidebar; BargainBuddy; Browser Aid; CashToolbar; FreshBar; GameSpy; MoneyTree; Nail.exe; NaviSearch; navpsrvc.exe (also known as: W32/Forbot-EF, worm); SearchMeUp; SideStep; Spybot - Randex; SupportSoft; SurfSideKick; Win32.RBot; Winmon.exe (also known as: W32/Agobot-KA, trojan); WinMoviePlugIn; and InternetExplorer Plugin. Limited searching on these claims indicates that the tool does in fact remove these adware/malware items.

EliteBar fights back. The creators of SearchMiracle.EliteBar have specifically attempted to develope new variants to target the Elite Toolbar Remover (a fine recommendation of Calo's skills). Newer versions of the Remover have involved features and instructions in order to overcome these counterattacks:


The variants in circulation [since] the end of January 2005... do a cache detect of the words: "EliteToolbarRemoverV10.zip" which was the old name of our previous version 1.0.

If you are trying to download it from a mirror site you will receive the following error:

''Cannot copy file, Cannot read from file source or disk''

This is not a message from your operating system, but a stupid message from the malware that is actually running in your PC.

The new variants of the malware also completely conceal the presence of the EliteToolbarRemoverV10.exe, so that if you are opening the archive you can only see the readme.doc file that is attached to that and you cannot see the *.exe even though it is
[actually] there! After all, these are very clever programmers, aren't they?

Anyway, it is
[certain] that these people will also blacklist the new name of the zip we are using now, so if this occurs... we suggest you to download the software to another PC and [put] it on a diskette or a USB pendrive and run it on the infected PC in Safe Mode, as usual.

It is not clear whether or not these instructions are continue to apply to the newer versions of the tool. The instructions regarding running the tool in Safe Mode are not supposed to be necessary as of Version 2.1.2.

Special Offer. For those who find the 2.x.x. series does not work for them, SimplyTech is also continuing to download a 1.3.2 version from here:


In the words of Giancarlo Calo: "[W]e have decided to take the old v.1.3.x and fill it with the latest malware definitions, so we can now offer the v.1.3.2 that is more stable but is and remain a discontinued Beta product.It will no longer be supported, however, nor does SimplyTech have any specific plans to update its definitions in the future."

VGS on the Remover. The successive updates of the ETR can be followed by reading the following articles previously posted in the pages of Virtual Grub Street:


Downloads:

Latest Version. Version 2.1.2 of the Elite ToolBar Remover can be downloaded from the following locations:



Previous Versions. Previous versions of the Elite Toolbar Remover can be downloaded from the following locations:

Special Case Software. When downloading the Elite Toolbar Remover, the user may get an message indicating that she or he needs to install the following files: Msinet.ocx or Comctl32.ocx. Should this be the case, it will be necessary to download one of the following auxiliary files:

Calo recommends using the "Setup Kit" over the "DLL.zip" option.




Other VGS Freeware/Trialware Information Pages:




Also see:



[re: SearchMiracle.EliteBar Search Miracle Elite Bar EliteToolBar Elite Toolbar Elite Tool Bar Elitum ETBrun YupSearch Yup Search.]