Bazooka Adware and Spyware Scanner Log 138

****************************************
Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 19:27:44.
OS: Windows NT 5.1
Database version: 1.880000
Database format version: 1.020000
Database date: 20040312
Current date: 2004-03-17 19:27


****************************************
Result when scanning:

BookedSpace 100.200.301 bxxs5.dll
http://www.kephyr.com/spywarescanner/library/bookedspace/index.phtml

ClipGenie 102.444.947
HKEY_CURRENT_USER\SOFTWARE\ClipGenie\Prefs\DisplayName
http://www.kephyr.com/spywarescanner/library/clipgenie/index.phtml

eZula 122.927.150 %SystemDir%\ezstub.exe
C:\WINDOWS\System32\\ezstub.exe
http://www.kephyr.com/spywarescanner/library/ezula/index.phtml

Gator 112.198.918 %WinDir%\temp\adware\
C:\WINDOWS\temp\adware\
http://www.kephyr.com/spywarescanner/library/gain/index.phtml

KeenValue.Updater 643.000.001 %ProgramsDir%\Common Files\updater\
C:\Program Files\Common Files\updater\
http://www.kephyr.com/spywarescanner/library/keenvalue.updater/index.phtml

MS Media Player GUID 404.888.000
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
http://www.kephyr.com/spywarescanner/library/msmediaplayerguid/index.phtml

My Search Bar 777.777.778 c:\Program Files\MyWay\
c:\Program Files\MyWay\
http://www.kephyr.com/spywarescanner/library/mysearchbar/index.phtml

n-CASE 102.165.199 %ProgramsDir%\n-Case\
C:\Program Files\n-Case\
http://www.kephyr.com/spywarescanner/library/ncase/index.phtml

Rapidblaster 733.733.734 %ProgramsDir%\RapidBlaster\
C:\Program Files\RapidBlaster\
http://www.kephyr.com/spywarescanner/library/rapidblaster/index.phtml

SaveNow 090.090.091 %ProgramsDir%\Save\
C:\Program Files\Save\
http://www.kephyr.com/spywarescanner/library/savenow/index.phtml

Scbar 190.092.391 %ProgramsDir%\scbar\
C:\Program Files\scbar\
http://www.kephyr.com/spywarescanner/library/scbar/index.phtml

Scbar 190.092.392 {00041A26-7033-432C-94C7-6371DE343822}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00041A26-7033-432C-94C7-6371DE343822}
http://www.kephyr.com/spywarescanner/library/scbar/index.phtml

ShopAtHomeSelect 123.000.444
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShopAtHomeSelect Agent\DisplayName
http://www.kephyr.com/spywarescanner/library/shopathomeselect/index.phtml

ShopAtHomeSelect 123.000.445 %SystemDir%\SahAgent.exe
C:\WINDOWS\System32\\SahAgent.exe
http://www.kephyr.com/spywarescanner/library/shopathomeselect/index.phtml

Surebar 349.500.000 {D3F01312-8A3D-4D41-A4FA-FB61D295CB6B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3F01312-8A3D-4D41-A4FA-FB61D295CB6B}
http://www.kephyr.com/spywarescanner/library/surebar/index.phtml

Surebar 349.500.001 %SystemDir%\surebar.dll
C:\WINDOWS\System32\\surebar.dll
http://www.kephyr.com/spywarescanner/library/surebar/index.phtml

SystemSoap Pro 957.500.001 %ProgramsDir%\System Soap Pro\
C:\Program Files\System Soap Pro\
http://www.kephyr.com/spywarescanner/library/systemsoappro/index.phtml

WeatherCast 342.000.001 %ProgramsDir%\WeatherCast\
C:\Program Files\WeatherCast\
http://www.kephyr.com/spywarescanner/library/weathercast/index.phtml

General Virus, Worm, Trojan 294.000.006 NDplDeamon
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NDplDeamon
http://www.kephyr.com/spywarescanner/library/generalvirus/index.phtml

ZipClix 930.000.000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZipClix\DisplayName
http://www.kephyr.com/spywarescanner/library/zipclix/index.phtml

ZipClix 930.000.001
HKEY_CLASSES_ROOT\CLSID\{319A68DB-06D0-46DA-9F93-A810D5A70836}\InprocServer32\ThreadingModel
http://www.kephyr.com/spywarescanner/library/zipclix/index.phtml

ZipClix 930.000.002 %ProgramsDir%\ZipClix\
C:\Program Files\ZipClix\
http://www.kephyr.com/spywarescanner/library/zipclix/index.phtml

ZipClix 930.000.003 {319A68DB-06D0-46DA-9F93-A810D5A70836}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{319A68DB-06D0-46DA-9F93-A810D5A70836}
http://www.kephyr.com/spywarescanner/library/zipclix/index.phtml

ZipClix 930.000.003 {319A68DB-06D0-46DA-9F93-A810D5A70836}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{319A68DB-06D0-46DA-9F93-A810D5A70836}
http://www.kephyr.com/spywarescanner/library/zipclix/index.phtml

****************************************
Auto start entries:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TFTP904
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TFTP904
C:\Documents and Settings\Molly\Start Menu\Programs\Startup\desktop.ini
C:\WINDOWS\Installer\{A839294B-70A9-11D5-9F5A-0050DAD742CD}\_299368D.exe
C:\Documents and Settings\Molly\Start Menu\Programs\Startup\desktop.ini
C:\WINDOWS\Installer\{A839294B-70A9-11D5-9F5A-0050DAD742CD}\_299368D.exe

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
winlogon winlogin.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\winlogon

NDplDeamon winlogin.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NDplDeamon

PCDRealtime C:\WINDOWS\realtime.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PCDRealtime

ctfmon.exe C:\WINDOWS\System32\ctfmon.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe

AIM C:\Program Files\AIM\aim.exe -cnetwait.odl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AIM

winlogon winlogin.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\winlogon


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{00041A26-7033-432C-94C7-6371DE343822} not set C:\Program Files\scbar\v2\scbar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00041A26-7033-432C-94C7-6371DE343822}

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{69EE5EB7-F8AD-0BD3-79FC-BCBC7BDF5473} not set C:\WINDOWS\system32\djfeizzo.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69EE5EB7-F8AD-0BD3-79FC-BCBC7BDF5473}

{BCF96FB4-5F1B-497B-AECC-910304A55011} not set C:\WINDOWS\hhU.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BCF96FB4-5F1B-497B-AECC-910304A55011}

{D3F01312-8A3D-4D41-A4FA-FB61D295CB6B} surebar Helper C:\WINDOWS\System32\surebar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3F01312-8A3D-4D41-A4FA-FB61D295CB6B}


****************************************
Toolbars:

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINDOWS\System32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{319A68DB-06D0-46DA-9F93-A810D5A70836} C:\Program Files\Zipclix\zipclix.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{319A68DB-06D0-46DA-9F93-A810D5A70836}

{270B845C-712C-4773-BEE0-AE2D2001CD0F} C:\WINDOWS\System32\surebar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{270B845C-712C-4773-BEE0-AE2D2001CD0F}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{319A68DB-06D0-46DA-9F93-A810D5A70836} C:\Program Files\Zipclix\zipclix.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{319A68DB-06D0-46DA-9F93-A810D5A70836}

{270B845C-712C-4773-BEE0-AE2D2001CD0F} C:\WINDOWS\System32\surebar.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{270B845C-712C-4773-BEE0-AE2D2001CD0F}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINDOWS\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} C:\WINDOWS\System32\Shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}

{30D02401-6A81-11D0-8274-00C04FD5AE38} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38}

{32683183-48a0-441b-a342-7c2a440a9478} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}


****************************************
All processes:

[System Process]
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
LSASS.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SPOOLSV.EXE
ALG.EXE
Crypserv.exe
MDM.EXE
NVSVC32.EXE
SVCHOST.EXE
TMNTSRV.EXE
EXPLORER.EXE
CTFMON.EXE
AIM.EXE
msmsgs.exe
CSRSS.EXE
WINLOGON.EXE
EXPLORER.EXE
CTFMON.EXE
AIM.EXE
PNTIOMON.exe
pccntupd.exe
spywarescanner.exe

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

http://search.searchenhancement.com/nph-enhanced.cgi?affid=sesm&sstring=
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\

Default_Page_URL http://www.sony.com/vaiopeople
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page C:\WINDOWS\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://www.searchenhancement.com/searchbar/iev1.html
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://www.iquicksearch.net/search.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

http://search.searchenhancement.com/nph-enhanced.cgi?affid=sesm&sstring=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\

provider
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Local Page C:\WINDOWS\System32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://www.iquicksearch.net/search.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://www.iquicksearch.net/search.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://yahoo.com/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://www.iquicksearch.net/search.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant


****************************************