Adware Alert – POKAPOKA

Filenames starting with "Pokapoka" install with an adware program called SearchMiracle.Elitebar. These files may include pokapoka.exe and pokapoka followed by any 2 numbers. Thus far we've seen pokapoka62.exe through pokapoka70.exe. SearchMiracle generates popup ads while Elitebar adds a browser search hijacker toolbar to your browser.

Because this is a combination of two adware programs, they install a large number of files on your system including: files that start with kalv or elite followed by 3 random letters and ending with 32.exe (eg kalvcaw32.exe, elitevmd32.exe) winlsj32.exe, winewi32.exe, winsop32.exe, winzhh32.exe, winclj32.exe, atas.exe, kcdbhba.dll, gbhfk.dll, v2.dll, v3.dll, elitebar eliteb~2.dll, and elitebar version xx.dll (where xx is a number between 20 and 55).

These programs create registry entries so that they run on system startup. We also see users report that they try to access the web and keep coming back after trying to remove them. Some report that they're a resource hog slowing system performance.

We'd recommend using WinPatrol to remove these files. First, go to your Active Tasks tab and kill all of the files listed above that appear on your system. You should also kill any other files you see there starting with "kalv***32.exe" or "elite***32.exe" where the asterisks represent random letters. You'll also want to kill any filenames starting with "elitebar" followed by random numbers. If you don't kill all of these files at once, they'll restart each other. So please hold down the CTRL key on your keyboard while left clicking each file. As you do this, you'll see them highlight. When all are highlighted, click the KILL button. Next, repeat this process under your Startup Programs and IE Helpers. If you run WinPatrol 8.x or later, you can right click each file and select "Delete file on reboot".

Adware

Remove