Bazooka Adware and Spyware Scanner Log 188

****************************************
Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 11:31:01.
OS: Windows 98
Database version: 1.930000
Database format version: 1.020000
Database date: 20040326
Current date: 2004-04-02 11:31


****************************************
Result when scanning:

Winpup 340.800.001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\comms\ren
http://www.kephyr.com/spywarescanner/library/winpup/index.phtml

****************************************
Auto start entries:
C:\Program Files\ashampoo\Ashampoo Mail Virus Blocker\Server.exe
D:\Program Files\Dachshund Software\Hare\Hare.exe
E:\Program Files\say time\SayTime.exe

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
ScanRegistry C:\WINDOWS\scanregw.exe /autorun
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ScanRegistry

Zasobnik systemowy SysTray.Exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Zasobnik systemowy

Scan Detector e:\PROGRA~1\PRIMAX\POWERT~1\Pmxdetect.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Scan Detector

PrimaLauncher C:\WINDOWS\SYSTEM\Launcher.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PrimaLauncher

LWBMOUSE E:\Program Files\PERFECT SERIES\SCROLL MOUSE\4.0\MOUSE32A.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\LWBMOUSE

PwrUpTweakMe C:\WINDOWS\SYSTEM\PUPSTTWK.EXE /TWEAK
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PwrUpTweakMe

AVG_CC D:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AVG_CC

mspwr C:\WINDOWS\SYSTEM\pupstman.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\mspwr

Avgserv9.exe D:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Avgserv9.exe

TuneUp MemOptimizer E:\PROGRAM FILES\TUNEUP UTILITIES\MEMOPTIMIZER.EXE autostart
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\TuneUp MemOptimizer


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{02478D38-C3F9-4efb-9B51-7695ECA05670} C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\PROGRAM FILES\ADOBE\ACROBAT 5.0 CE\READER\ACTIVEX\ACROIEHELPER.OCX
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\windows\googletoolbar_en_2.0.95-deleon.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}

{0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} D:\PROGRAM FILES\DAP\DAPIEBAR.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0096CC0A-623C-4829-AD9C-19AF0DC9D8FE}

{49E0E0F0-5C30-11D4-945D-000000000003} D:\PROGRA~1\ASHAMPOO\ASHAMP~3\POPUP.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{49E0E0F0-5C30-11D4-945D-000000000003}

{6754A456-BAD9-11D4-93D3-00B0D03A2F91} E:\PROGRA~1\ODIGO\BIN\ODIGOBHO.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6754A456-BAD9-11D4-93D3-00B0D03A2F91}

{259CC600-C2B4-11d3-8754-008048C4AC6F} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{259CC600-C2B4-11d3-8754-008048C4AC6F}\InprocServer32

System error message: System nie odnalazł określonego pliku.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{259CC600-C2B4-11d3-8754-008048C4AC6F}


****************************************
Toolbars:

{EF99BD32-C1FB-11D2-892F-0090271D4F88} C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

{862fb893-b24b-4fad-80d3-a1158eb34db4} C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNETSEARCHBAR.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{862fb893-b24b-4fad-80d3-a1158eb34db4}

{2318C2B1-4965-11d4-9B18-009027A5CD4F} C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLENAV.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{2318C2B1-4965-11d4-9B18-009027A5CD4F}

{C2565A0E-1C15-4021-9BBF-5D56457D3797} C:\PROGRA~1\INVENT~1\NOTESP~1\NNOTES.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{C2565A0E-1C15-4021-9BBF-5D56457D3797}

{62999427-33FC-4baf-9C9C-BCE6BD127F08} D:\PROGRAM FILES\DAP\DAPIEBAR.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{62999427-33FC-4baf-9C9C-BCE6BD127F08}

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINDOWS\SYSTEM\MSDXM.OCX
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\SYSTEM\BROWSEUI.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\SYSTEM\BROWSEUI.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\SYSTEM\BROWSEUI.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{2318C2B1-4965-11D4-9B18-009027A5CD4F} C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLENAV.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

{EF99BD32-C1FB-11D2-892F-0090271D4F88} C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

{862FB893-B24B-4FAD-80D3-A1158EB34DB4} C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNETSEARCHBAR.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{862FB893-B24B-4FAD-80D3-A1158EB34DB4}

{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0}\InprocServer32

System error message: System nie odnalazł określonego pliku.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0}

{4E7BD74F-2B8D-469E-92EA-EC65A294AE31} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{4E7BD74F-2B8D-469E-92EA-EC65A294AE31}\InprocServer32

System error message: System nie odnalazł określonego pliku.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4E7BD74F-2B8D-469E-92EA-EC65A294AE31}

{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\InprocServer32

System error message: System nie odnalazł określonego pliku.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}

{C2565A0E-1C15-4021-9BBF-5D56457D3797} C:\PROGRA~1\INVENT~1\NOTESP~1\NNOTES.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{C2565A0E-1C15-4021-9BBF-5D56457D3797}

{724D43A0-0D85-11D4-9908-00400523E39A} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{724D43A0-0D85-11D4-9908-00400523E39A}\InprocServer32

System error message: System nie odnalazł określonego pliku.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{724D43A0-0D85-11D4-9908-00400523E39A}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINDOWS\SYSTEM\SHDOCVW.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{4528BBE0-4E08-11D5-AD55-00010333D0AD} C:\PROGRAM FILES\YAHOO!\COMPANION\MODULES\MESSMOD\V2\YHEX_O2.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}

{C107F7A0-B489-11d2-B2FE-005004055BFB} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{C107F7A0-B489-11d2-B2FE-005004055BFB}\InprocServer32

System error message: System nie odnalazł określonego pliku.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C107F7A0-B489-11d2-B2FE-005004055BFB}

{4528BBE0-4E08-11D5-AD55-00010333D0AD} C:\PROGRAM FILES\YAHOO!\COMPANION\MODULES\MESSMOD\V2\YHEX_O2.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}

{EFA24E62-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\SYSTEM\SHDOCVW.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}

{EFA24E61-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\SYSTEM\SHDOCVW.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}

{32683183-48a0-441b-a342-7c2a440a9478} C:\WINDOWS\SYSTEM\BROWSEUI.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}


****************************************
All processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
D:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
E:\PROGRAM FILES\PRIMAX\POWERTWAIN\PMXDETECT.EXE
C:\WINDOWS\SYSTEM\LAUNCHER.EXE
E:\PROGRAM FILES\PERFECT SERIES\SCROLL MOUSE\4.0\MOUSE32A.EXE
D:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\PUPSTMAN.EXE
E:\PROGRAM FILES\TUNEUP UTILITIES\MEMOPTIMIZER.EXE
C:\PROGRAM FILES\ASHAMPOO\ASHAMPOO MAIL VIRUS BLOCKER\SERVER.EXE
E:\PROGRAM FILES\SAY TIME\SAYTIME.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\INTEGRATOR.EXE
D:\PROGRAM FILES\INTERIAPL\NETSTARTER\NETSTART.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
D:\PROGRAM FILES\DAP\DAP.EXE
C:\WINDOWS\PULPIT\DOWNLOAD RFASETUP NOW.EXE
E:\PROGRAM FILES\BAZOOKA SPYWARE SCANNER\SPYWARESCANNER.EXE

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Default_Page_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://rd.yahoo.com/customize/ymsgr/defaults/sb/*http://www.yahoo.com/ext/search/search.html
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://www.wp.pl
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page


HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\

SearchAssistant http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

http://home.microsoft.com/access/autosearch.asp?p=%s
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\

provider
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Local Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://www.wp.pl/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

Use Search Asst no
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst


HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\

User Stylesheet
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Styles\User Stylesheet


****************************************




Related links

Bazooka - Free scan for spyware, adware, trojan horses, keyloggers, etc. Detects more than 500 potentially unwanted applications. Freeware!

The File Database - Search the file database for more information. Free!

PopUp Blocker Test - Find out if your pop-up killer can handle all pop-ups. Free!

Kephyr Labs - Find out what is going on at Kephyr. Try products in an early stage of development.



FreeFixer
Read more about FreeFixer, Kephyr's latest spyware removal tool.
Home & Products |  Legal |  Privacy |  Search

© Kephyr, 2003-2012. HtmlTidy, HTML 4.01, CSS andy@kephyr.com