Annoying Earthlink Problem

[rubendodge]

Description:
Ok now I am currently running into a problem with a friends computer that I cannot fix. I have deleted all earthlink files. I removed all bootup locations that were earthlink. I removed all hooks including their search hook. I scanned the computer using multiple scanners and have not been able to kill this problem. The issue is that when you open My Computer,Internet Explorer,Firefox,or any program using the internet it will popup a box saying EarthLink Accelerator and it uses the micrsoft installer to "reinstall" Itself. Now it does this EVERYTIME you bootup the computer or open any of the programs I listed. Also when you try to update all other scanners besides superantispyware it open the earthlink thing and then opens internet explorer when you close it. Internet explorer fails to connect and update it aswell.I hope one of you can help us with this problem. Thank You in advance.

NOTE:It's been 2 years since he had it installed and he just wants this problem to go away.

System Info:
1.Operating System (Windows Xp Pro Sp2)
2.Computer Make/Model (Dell Latitude d820)
3.Ram (1 GB)
4.HardDrive (80gb)
5.Sound/Video Cards (Came with motherboard)
6.Anti-Virus(StopSign -Yes I know i told them it sucked-),SuperAntiSpyware,Malwarebytes-antispyware
7.Windows CD(Yes but it only works 50% of the time)

[Saving space - attachment deleted by admin]

[evilfantasy]

How long have you used eAcceleration/Stop Sign?

This is an unreliable product and I strongly suggest uninstalling it and using something better (free).

Create An Uninstall List

• Start HijackThis
  
• Click on the Open the Misc Tools section
  
• Click on the Open Uninstall Manager button.
  
• Click on the Save list button and specify where you would like to save this file and click Save.
  • When you press Save button a notepad will open with the contents of that file.
• Copy and paste that list in your reply.

[rubendodge]

I've tried uninstalling it and when we did it caused this problem. Now the only thing I can think of as being left is it hooked system files with a rootkit because I've checked everywhere.

[Saving space - attachment deleted by admin]

[evilfantasy]

How long have you used eAcceleration/Stop Sign?

This is an unreliable product and I strongly suggest uninstalling it and using something better (free).

[rubendodge]

I removed it after doing the uninstall list so it was still their when I did the uninstall list. I am installing Avira and Zone Alarm for him. The earthlink bug is still here though. Please help .

[evilfantasy]

Run this online scan.

This scanner requires Internet Explorer

Use the ESET Nod32 Online Scanner

1. Check the box next to YES, I accept the Terms of Use.
2. Click Start
3. When asked, allow the activex control to install
4. Click Start
5. Make sure that the option Remove found threats and the option Scan unwanted applications is check marked.
6. Click Scan
7. Wait for the scan to finish
8. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
9. Add the C:\Program Files\EsetOnlineScanner\log.txt log into your next reply.

[rubendodge]

Ok It didn't detect any viruses so I will still post it.

[Saving space - attachment deleted by admin]

[evilfantasy]

OK, wanted to make sure there would be no malware possibly interfering with us.

Run a fresh HijackThis scan and post the log please.

[rubendodge]

Ok I finally got a chance to do the hijackthis log I was busy last night trying to fix his other laptop aswell. Anyways heres the updated log.

[Saving space - attachment deleted by admin]

[evilfantasy]

Download Disable/Remove Windows Messenger to the Desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the Desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the Desktop.

----------

Your Java is out of date.

Older versions have vulnerabilities that malicious sites can use to infect your system.

First install the new Sun Java Runtime Environment

Be sure to close all browser windows before beginning the install.

Remove the old version(s)

• Download JavaRa and unzip the file to your Desktop.
  
• Open JavaRA.exe and choose Remove Older Versions
  
• Once complete exit JavaRA and delete the program.
• Run CCleaner.

----------

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

- R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
- R3 - URLSearchHook: (no name) - ~EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
- O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
- O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis and restart the computer to register the changes made by HijackThis.

----------

Right click Internet Explorer on the desktop and choose Properties then select the connections tab. Can you adjust anything in there?

I'm having a hard time finding anything solid on the accelerator issue. What about re-installing it and then using the un-installer to remove it?

EarthLink Stand Alone Accelerator - How to Install

EarthLink Stand Alone Accelerator - How to Uninstall

[rubendodge]

Ok I did everything but the earthing install and uninstall thing wont work as we are missing the cd because its been over a year or 2 ago. Anyways what should we test for next? And I still cant believe I couldn't fix this problem myself seeing as ive been enrolled in one of the malware removal univeristies and haven't managed to be able to remove these problems with any of the tools that you can use including the expert ones lol. I suspect earthlink hooked into windows system files.

[Saving space - attachment deleted by admin]

[evilfantasy]

I wonder if you can find and disable or delete it with Autoruns?

Download Autoruns for Windows and search for the related entry and then delete it.

• Create a new folder on your hard drive called AutoRuns (C:\AutoRuns) and extract (unzip) the file there. (click HERE if your not sure how to do this.)
  
• Open the folder and double-click on autoruns.exe to launch it.
  
• If using Windows Vista, Right-click autoruns.exe and Run As Administrator
  
• Please be patient as it scans and populates the entries.
• When done scanning, it will say Ready at the bottom.
  
• Scroll through the list and look for a startup entry related to the Earthlink file(s).
• Right click on the entry and choose delete
  
• Reboot your computer and see if the problem is solved.

[rubendodge]

Lol dude I love you lol you had me remove the searchhooks without and name and it turns out removing all of those got rid of the problem thank you dude I will have to keep a note of that when I start working on the malware univerisity thing again.  Lol when the guy gets home he promised me a blizzard for fixing it . Anyways tnx dude I cant wait till 1 year from now when I can help out people more like you did . 

[evilfantasy]

I have never seen anything like that so had to do some out-of-the-box thinking. Glad it worked.