Bazooka Adware and Spyware Scanner Log 293

****************************************
Bazooka Adware and Spyware Scanner v1.13.01
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 14:43:53.
OS: Windows NT 5.1
Database version: 2.010000
Database format version: 1.020000
Database date: 20040512
Current date: 2004-05-15 14:43


****************************************
Result when scanning:

MS Media Player GUID 404.888.000
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
http://www.kephyr.com/spywarescanner/library/msmediaplayerguid/index.phtml

General Virus, Worm, Trojan 294.000.006 PMedia
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PMedia
http://www.kephyr.com/spywarescanner/library/generalvirus/index.phtml

****************************************
Auto start entries:
C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe /start
C:\Program Files\MacOpener\MacName.exe
C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l
C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe /start
C:\Program Files\MacOpener\MacName.exe
C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l
C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\Albert Lewis\Start Menu\Programs\Startup\DESKTOP.INI
C:\Documents and Settings\Albert Lewis\Start Menu\Programs\Startup\DESKTOP.INI

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
NvCplDaemon RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon

AdaptecDirectCD "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AdaptecDirectCD

Dell|Alert C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Dell|Alert

USRpdA C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\USRpdA

ADUserMon C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ADUserMon

MacLicense "C:\Program Files\MacOpener\MacLic.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MacLicense

Iomega Startup Options C:\Program Files\Iomega\Common\ImgStart.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Iomega Startup Options

Iomega Drive Icons C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Iomega Drive Icons

Deskup C:\Program Files\Iomega\DriveIcons\deskup.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Deskup

CARPService carpserv.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CARPService

PMedia "C:\Program Files\Common Files\Media\winsrvc.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PMedia

LVCOMS C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\LVCOMS

LogitechGalleryRepair C:\Program Files\Logitech\ImageStudio\ISStart.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\LogitechGalleryRepair

LogitechImageStudioTray C:\Program Files\Logitech\ImageStudio\LogiTray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\LogitechImageStudioTray

McAfee Guardian "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\McAfee Guardian

VSOCheckTask "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\VSOCheckTask

VirusScan Online "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\VirusScan Online

MCAgentExe c:\PROGRA~1\mcafee.com\agent\mcagent.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MCAgentExe

MCUpdateExe C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MCUpdateExe

QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task

TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TkBellExe

nwiz nwiz.exe /install
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\nwiz

DELDIR0.EXE "C:\DOCUME~1\ALBERT~1\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\DELDIR0.EXE

ctfmon.exe C:\WINDOWS\System32\ctfmon.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe

msnmsgr "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msnmsgr

WebCamRT.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WebCamRT.exe

McAfee.InstantUpdate.Monitor "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\McAfee.InstantUpdate.Monitor

NvMediaCenter RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\NvMediaCenter


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{0CF0B8EE-6596-11D5-A98E-0003470BB48E} CCHelper C:\Program Files\Panicware\Pop-Up Stopper Pro\CCHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0CF0B8EE-6596-11D5-A98E-0003470BB48E}

{1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} not set C:\WINDOWS\mspljg.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1}

{7011471D-3F74-498E-88E1-C0491200312D} not set C:\PROGRA~1\COMMON~1\Media\OTGlove.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7011471D-3F74-498E-88E1-C0491200312D}


****************************************
Toolbars:

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINDOWS\System32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B1E741E7-1E77-40D4-9FD8-51949B9CCBD0}

{BA52B914-B692-46c4-B683-905236F6F655} c:\progra~1\mcafee.com\vso\mcvsshl.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{BA52B914-B692-46c4-B683-905236F6F655}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{E6AE90A4-1B01-47F0-AA78-E6B122E145E9} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{E6AE90A4-1B01-47F0-AA78-E6B122E145E9}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{E6AE90A4-1B01-47F0-AA78-E6B122E145E9}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINDOWS\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} C:\WINDOWS\System32\Shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}

{32683183-48a0-441b-a342-7c2a440a9478} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}

{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}


****************************************
All processes:

[System Process]
System
smss.exe
CSRSS.EXE
winlogon.exe
SERVICES.EXE
lsass.exe
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
explorer.exe
SPOOLSV.EXE
Directcd.exe
DAMon.exe
ADUserMon.exe
Imgicon.exe
carpserv.exe
winsrvc.exe
LVComS.exe
LogiTray.exe
CMGrdian.exe
mcvsshld.exe
mcagent.exe
qttask.exe
McVSEscn.exe
realsched.exe
ctfmon.exe
RuLaunch.exe
RUNDLL32.EXE
MacName.exe
qbdagent2002.exe
WZQKPICK.EXE
rnathchk.exe
inetinfo.exe
AppServices.exe
FormatM.exe
mcvsrte.exe
MDM.EXE
nvsvc32.exe
SVCHOST.EXE
ADService.exe
McShield.exe
spywarescanner.exe

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Search http://nkvd.us/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search

Default_Page_URL http://smbusiness.dellnet.com/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://nkvd.us/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page C:\WINDOWS\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Page http://nkvd.us/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://nkvd.us/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://nkvd.us/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://nkvd.us/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://www.nkvd.us/
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://www.nkvd.us/
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

Search http://nkvd.us/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search

provider
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Default_Page_URL http://nkvd.us/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://nkvd.us/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page C:\WINDOWS\System32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://nkvd.us/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://nkvd.us/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://nkvd.us/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://nkvd.us/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://nkvd.us/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\CustomizeSearch


****************************************