Bazooka Adware and Spyware Scanner Log 329

****************************************
Bazooka Adware and Spyware Scanner v1.13.01
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 10:19:13.
OS: Windows NT 5.1
Database version: 2.040000
Database format version: 1.020000
Database date: 20040518
Current date: 2004-05-25 10:19


****************************************
Result when scanning:

General Virus, Worm, Trojan 294.000.003 Internet Explorer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Internet
Explorer
http://www.kephyr.com/spywarescanner/library/generalvirus/index.phtml

****************************************
Auto start entries:
C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\DESKTOP.INI
C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\DESKTOP.INI
C:\Documents and Settings\Brad Brown\Start
Menu\Programs\Startup\DESKTOP.INI
C:\Documents and Settings\Brad Brown\Start
Menu\Programs\Startup\DESKTOP.INI

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
DwlClient C:\Program Files\Common Files\Dell\EUSW\Support.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\DwlClient

NvCplDaemon RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon

diagent "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe"
startup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\diagent

Internet Explorer c:\Program Files\Internet Explorer\shttps\http.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Internet
Explorer

AVG_CC C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AVG_CC

MCUpdateExe C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MCUpdateExe

nwiz nwiz.exe /install
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\nwiz

Ad-watch "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Ad-watch

Ad-aware "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Ad-aware

MSMSGS "C:\Program Files\Messenger\msmsgs.exe" /background
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS

NvMediaCenter RUNDLL32.EXE
C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\NvMediaCenter

ctfmon.exe C:\WINDOWS\System32\ctfmon.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{00C6482D-C502-44C8-8409-FCE54AD9C208} not set C:\Program
Files\TechSmith\SnagIt 7\SnagItBHO.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program
Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{1C78AB3F-A857-482e-80C0-3A1E5238A565} not
set C:\WINDOWS\System32\toolbar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{1C78AB3F-A857-482e-80C0-3A1E5238A565}


****************************************
Toolbars:

{327C2873-E90D-4c37-AA9D-10AC9BABA46C} C:\Program
Files\Canon\Easy-WebPrint\Toolband.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\{327C2873-E90D-4c37-AA9D-10AC9BABA46C}

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINDOWS\System32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} C:\Program Files\TechSmith\SnagIt
7\SnagItIEAddin.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}

{EF99BD32-C1FB-11D2-892F-0090271D4F88} Error when opening a registry key,
the key doesn't exist. Key:
HKEY_CLASSES_ROOT\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\ShellBrowser\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\ShellBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{EF99BD32-C1FB-11D2-892F-0090271D4F88} Error when opening a registry key,
the key doesn't exist. Key:
HKEY_CLASSES_ROOT\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\WebBrowser\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

{4528BBE0-4E08-11D5-AD55-00010333D0AD} Error when opening a registry key,
the key doesn't exist. Key:
HKEY_CLASSES_ROOT\CLSID\{4528BBE0-4E08-11D5-AD55-00010333D0AD}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINDOWS\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} C:\WINDOWS\System32\Shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}

{30D02401-6A81-11D0-8274-00C04FD5AE38} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38}

{32683183-48a0-441b-a342-7c2a440a9478} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{32683183-48a0-441b-a342-7c2a440a9478}

{4528BBE0-4E08-11D5-AD55-00010333D0AD} Error when opening a registry key,
the key doesn't exist. Key:
HKEY_CLASSES_ROOT\CLSID\{4528BBE0-4E08-11D5-AD55-00010333D0AD}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}

{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}

{EFA24E61-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}

{EFA24E62-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}

{EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}


****************************************
All processes:

[System Process]
System
smss.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
explorer.exe
Support.exe
NotifyAlert.exe
http.exe
avgcc32.exe
Ad-watch.exe
rundll32.exe
ctfmon.exe
diagent.exe
alg.exe
avgserv.exe
cisvc.exe
CTsvcCDA.EXE
mcvsrte.exe
MDM.EXE
nvsvc32.exe
svchost.exe
MsPMSPSv.exe
WZCBDLS.exe
YPager.exe
McShield.exe
wuauclt.exe
cidaemon.exe
cidaemon.exe
IEXPLORE.EXE
IEXPLORE.EXE
IEXPLORE.EXE
IEXPLORE.EXE
spywarescanner.exe

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Local Page C:\WINDOWS\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Start Page about:blank
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

Use Search Asst no
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Use Search
Asst

SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Search\SearchAssistant

CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Search\CustomizeSearch

http://

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

provider yaho
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\SearchUrl\provider

Local Page C:\WINDOWS\System32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Start Page http://www.google.com/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

Use Search Asst no
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search
Asst


****************************************