Bazooka Adware and Spyware Scanner Log 113

****************************************
Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 11:09:18.
OS: Windows NT 5.0
Database version: 1.840000
Database format version: 1.020000
Database date: 20040301
Current date: 2004-03-04 11:09


****************************************
Result when scanning:

Cydoor 399.000.001 Cd_clint.dll
http://www.kephyr.com/spywarescanner/library/cydoor/index.phtml

Gator 112.997.000 GMT.exe
http://www.kephyr.com/spywarescanner/library/gain/index.phtml

Gator 102.098.947 CMESys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CMESys
http://www.kephyr.com/spywarescanner/library/gain/index.phtml

Gator eWallet 432.900.000 %ProgramsDir%\Gator.com\Gator\
C:\Program Files\Gator.com\Gator\
http://www.kephyr.com/spywarescanner/library/gatorewallet/index.phtml

HoHBBLOCKar 177.778.977 HoHBBLOCKar
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HoHBBLOCKar
http://www.kephyr.com/spywarescanner/library/hoHBBLOCKar/index.phtml

HoHBBLOCKar 177.778.978 {B195B3B3-8A05-11D3-97A4-0004ACA6948E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B195B3B3-8A05-11D3-97A4-0004ACA6948E}
http://www.kephyr.com/spywarescanner/library/hoHBBLOCKar/index.phtml

HoHBBLOCKar 177.778.978 {B195B3B3-8A05-11D3-97A4-0004ACA6948E}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{B195B3B3-8A05-11D3-97A4-0004ACA6948E}
http://www.kephyr.com/spywarescanner/library/hoHBBLOCKar/index.phtml

HoHBBLOCKar 177.778.978 {B195B3B3-8A05-11D3-97A4-0004ACA6948E}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B195B3B3-8A05-11D3-97A4-0004ACA6948E}
http://www.kephyr.com/spywarescanner/library/hoHBBLOCKar/index.phtml

HoHBBLOCKar 177.778.978 {BECAFC17-BAF9-11D4-B492-00D0B77F0A6D}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{BECAFC17-BAF9-11D4-B492-00D0B77F0A6D}
http://www.kephyr.com/spywarescanner/library/hoHBBLOCKar/index.phtml

HoHBBLOCKar 177.778.979 {B195B3B3-8A05-11D3-97A4-0004ACA6948E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B195B3B3-8A05-11D3-97A4-0004ACA6948E}
http://www.kephyr.com/spywarescanner/library/hoHBBLOCKar/index.phtml

Instant Access Dialer.B 848.000.000 ia.dll
http://www.kephyr.com/spywarescanner/library/instantaccessdialer.b/index.phtml

Instant Access Dialer.C 849.000.001 ia.dll
http://www.kephyr.com/spywarescanner/library/instantaccessdialer.c/index.phtml

MS Media Player GUID 404.888.000
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
http://www.kephyr.com/spywarescanner/library/msmediaplayerguid/index.phtml

WildTangent 999.888.998 %Windir%\wt
C:\WINNT\wt
http://www.kephyr.com/spywarescanner/library/wildtangent/index.phtml

****************************************
Auto start entries:
C:\Program Files\Gator.com\Gator\Gator.exe
C:\Program Files\Common Files\GMT\GMT.exe /startup
C:\Program Files\Network Associates\PGPNT\PGPTray.exe
C:\MSSQL7\Binn\sqlmangr.exe /n
C:\Program Files\Gator.com\Gator\Gator.exe
C:\Program Files\Common Files\GMT\GMT.exe /startup
C:\Program Files\Network Associates\PGPNT\PGPTray.exe
C:\MSSQL7\Binn\sqlmangr.exe /n

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
NeroCheck C:\WINNT\system32\NeroCheck.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NeroCheck

IgfxTray C:\WINNT\system32\igfxtray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IgfxTray

Inoculator C:\Program Files\Inoculator\inoc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Inoculator

CMESys "C:\Program Files\Common Files\CMEII\CMESys.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CMESys

QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task

AVG_CC C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AVG_CC

HotKeysCmds C:\WINNT\system32\hkcmd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HotKeysCmds

Nokia Tray Application C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Nokia Tray Application

DataLayer C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\DataLayer

Desktop Tool "C:\Program Files\Alcatel One Touch 535-735\DesktopTool\DesktopTool.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Desktop Tool

QuikShield qkshield.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuikShield

B-Reader C:\Program Files\Harshil's Softwares\Birthday Reminder\B-Reader.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\B-Reader

A-Reader C:\Program Files\Harshil's Softwares\Birthday Reminder\A-Reader.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\A-Reader

HoHBBLOCKar C:\Program Files\HoHBBLOCKar\bin\4.4.2.0\HbInst.exe /Upgrade
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HoHBBLOCKar

msnmsgr "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msnmsgr

PlaxoUpdate C:\WINNT\Plaxo\1.4.2.25\InstallStub.exe -a
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\PlaxoUpdate


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

Ashampoo PopUpBlocker C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUpKiller.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Ashampoo PopUpBlocker

cnet "C:\Program Files\Kontiki\bin\kontiki.exe" -s cnet -q
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\cnet

HistoryKill C:\Program Files\HistoryKill\histkill.exe /startup
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\HistoryKill


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{029CA12C-89C1-46a7-A3C7-82F2F98635CB} not set C:\Program Files\Kontiki\bin\bh309190.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{029CA12C-89C1-46a7-A3C7-82F2F98635CB}

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{49E0E0F0-5C30-11D4-945D-000000000003} not set C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUp.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{49E0E0F0-5C30-11D4-945D-000000000003}

{A5366673-E8CA-11D3-9CD9-0090271D075B} not set C:\PROGRA~1\FlashGet\jccatch.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5366673-E8CA-11D3-9CD9-0090271D075B}

{B195B3B3-8A05-11D3-97A4-0004ACA6948E} HoHBBLOCKar C:\Program Files\HoHBBLOCKar\bin\4.4.2.0\HbHostIE.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B195B3B3-8A05-11D3-97A4-0004ACA6948E}

{D6862A22-1DD6-11D3-BB7C-444553540000} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{D6862A22-1DD6-11D3-BB7C-444553540000}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D6862A22-1DD6-11D3-BB7C-444553540000}


****************************************
Toolbars:

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINNT\System32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{E0E899AB-F487-11D5-8D29-0050BA6940E3} C:\PROGRA~1\FlashGet\fgiebar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{E0E899AB-F487-11D5-8D29-0050BA6940E3}

{B195B3B3-8A05-11D3-97A4-0004ACA6948E} C:\Program Files\HoHBBLOCKar\bin\4.4.2.0\HbHostIE.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B195B3B3-8A05-11D3-97A4-0004ACA6948E}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{B195B3B3-8A05-11D3-97A4-0004ACA6948E} C:\Program Files\HoHBBLOCKar\bin\4.4.2.0\HbHostIE.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{B195B3B3-8A05-11D3-97A4-0004ACA6948E}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{EF99BD32-C1FB-11D2-892F-0090271D4F88} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

{B195B3B3-8A05-11D3-97A4-0004ACA6948E} C:\Program Files\HoHBBLOCKar\bin\4.4.2.0\HbHostIE.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B195B3B3-8A05-11D3-97A4-0004ACA6948E}

{4528BBE0-4E08-11D5-AD55-00010333D0AD} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{4528BBE0-4E08-11D5-AD55-00010333D0AD}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINNT\system32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{32683183-48a0-441b-a342-7c2a440a9478} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}

{4528BBE0-4E08-11D5-AD55-00010333D0AD} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{4528BBE0-4E08-11D5-AD55-00010333D0AD}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}

{BECAFC17-BAF9-11D4-B492-00D0B77F0A6D} C:\Program Files\HoHBBLOCKar\bin\4.4.2.0\HbHostIE.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{BECAFC17-BAF9-11D4-B492-00D0B77F0A6D}

{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} C:\WINNT\system32\shell32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}

{EFA24E62-B078-11D0-89E4-00C04FC9E26E} C:\WINNT\system32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}

{EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINNT\system32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}


****************************************
All processes:

[System Process]
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
LSASS.EXE
svchost.exe
svchost.exe
spoolsv.exe
msdtc.exe
avgserv.exe
tcpsvcs.exe
LLSSRV.EXE
sqlservr.exe
regsvc.exe
RsFsa.exe
RsSub.exe
LOCATOR.EXE
explorer.exe
mstask.exe
SNMP.EXE
WinMgmt.exe
WINS.EXE
svchost.exe
dfssvc.exe
DNS.EXE
inetinfo.exe
mqsvc.exe
sqlagent.exe
svchost.exe
igfxtray.exe
CMESys.exe
avgcc32.exe
hkcmd.exe
NclTray.exe
DataLayer.exe
ServiceLayer.ex
Hbinst.exe
msnmsgr.exe
InstallStub.exe
flashget.exe
kontiki.exe
histkill.exe
Gator.exe
GMT.exe
hkPopupKiller.e
sqlmangr.exe
svchost.exe
OUTLOOK.EXE
MAPISP32.EXE
Hbsrv.exe
IEXPLORE.EXE
spywarescanner.

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Default_Page_URL http://www.portalsearching.com/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Local Page C:\WINNT\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://www.portalsearching.com/search/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar

Start Page http://www.portalsearching.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page


HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\

SearchAssistant http://www.hoHBBLOCKar.com/dyn/hoHBBLOCKar/3.0/sb_searchPageHome.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

http://www.portalsearching.com/search.php?phrase=%s
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\

provider
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Default_Page_URL http://www.portalsearching.com/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Local Page http://www.portalsearching.com
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Start Page http://utlconnect/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page


HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\


****************************************




Related links

Bazooka - Free scan for spyware, adware, trojan horses, keyloggers, etc. Detects more than 500 potentially unwanted applications. Freeware!

The File Database - Search the file database for more information. Free!

PopUp Blocker Test - Find out if your pop-up killer can handle all pop-ups. Free!

Kephyr Labs - Find out what is going on at Kephyr. Try products in an early stage of development.




FreeFixer
I'm working on a new spyware removal tool. Would you like to help me with the testing?
Koffix Blocker - Block bad web sites.
Home & Products |  Legal |  Search

© Kephyr, 2003-2006. HtmlTidy, HTML 4.01, CSS andy@kephyr.com