Bazooka Adware and Spyware Scanner Log 361

****************************************
Bazooka Adware and Spyware Scanner v1.13.01
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 08:42:35.
OS: Windows NT 5.0
Database version: 2.040000
Database format version: 1.020000
Database date: 20040518
Current date: 2004-05-19 08:42


****************************************
Result when scanning:

No potentially unwanted software found.
****************************************
Auto start entries:
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Iomega\Iomega Backup\dtiom98.exe /sc
C:\Program Files\Iomega\Tools\IMGICON.EXE
C:\Program Files\Iomega\Tools\IMGSTART.EXE
C:\Program Files\Iomega\Iomegaware\COMMANDER.EXE /startup
C:\Program Files\Iomega\QuikSync\QUIKSYNC.EXE NoStartUp
C:\WINNT\Seiko\slpcap.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Iomega\Iomega Backup\dtiom98.exe /sc
C:\Program Files\Iomega\Tools\IMGICON.EXE
C:\Program Files\Iomega\Tools\IMGSTART.EXE
C:\Program Files\Iomega\Iomegaware\COMMANDER.EXE /startup
C:\Program Files\Iomega\QuikSync\QUIKSYNC.EXE NoStartUp
C:\WINNT\Seiko\slpcap.exe
D:\Palm\HOTSYNC.EXE
C:\Program Files\SpywareGuard\sgmain.exe
D:\Palm\HOTSYNC.EXE
C:\Program Files\SpywareGuard\sgmain.exe

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
Synchronization Manager mobsync.exe /logon
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Synchronization Manager

Client Access Service "C:\Program Files\IBM\Client Access\CwbSvStr.Exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Client Access Service

Client Access Help Update "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Client Access Help Update

Client Access Check Version "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Client Access Check Version

QCWLICON C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QCWLICON

Tgcmd "C:\Program Files\Support.com\bin\tgcmd.exe /server"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Tgcmd

TPHOTKEY C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TPHOTKEY

PRPCMonitor PRPCUI.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PRPCMonitor

AGRSMMSG AGRSMMSG.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AGRSMMSG

Promon.exe Promon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Promon.exe

TP4EX tp4ex.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TP4EX

SynTPLpr C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SynTPLpr

SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SynTPEnh

UC_SMB
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\UC_SMB

ATIModeChange Ati2mdxx.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ATIModeChange

TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TkBellExe

QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task

SMS Application Launcher C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SMS Application Launcher

Emurayden PSX Emulator
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Emurayden PSX Emulator

vptray C:\PROGRA~1\Symantec\NavNT\vptray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\vptray

NeroCheck C:\WINNT\system32\NeroCheck.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NeroCheck

CitiVAN C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe /dontopenmycards
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CitiVAN

SunJavaUpdateSched C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched

mswspl
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\mswspl

Services Process C:\WINNT\system32\config\services.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Services Process

msnmsgr "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msnmsgr

tgcmd C:\Program Files\Support.com\bin\tgcmd.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\tgcmd


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{387EDF53-1CF2-4523-BC2F-13462651BE8C} CitiUS Shared Browser Helper Object C:\WINNT\system32\BhoCitUS.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{387EDF53-1CF2-4523-BC2F-13462651BE8C}

{4A368E80-174F-4872-96B5-0B27DDD11DB2} SpywareGuard Download Protection C:\Program Files\SpywareGuard\dlprotect.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A368E80-174F-4872-96B5-0B27DDD11DB2}

{53707962-6F74-2D53-2644-206D7942484F} not set C:\PROGRA~1\SPYBOT~1\SDHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}

{E8C0F153-B768-4e68-B14F-40F0E8531675} Citi Virtual Account Numbers Browser Helper Object C:\WINNT\System32\BhoCiti.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8C0F153-B768-4e68-B14F-40F0E8531675}


****************************************
Toolbars:

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINNT\system32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINNT\system32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} C:\WINNT\System32\Shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}

{32683183-48a0-441b-a342-7c2a440a9478} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}

{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} C:\WINNT\system32\shell32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}

{EFA24E62-B078-11D0-89E4-00C04FC9E26E} C:\WINNT\system32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}

{EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINNT\system32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}


****************************************
All processes:

[System Process]
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
LSASS.EXE
ibmpmsvc.exe
svchost.exe
svchost.exe
spoolsv.exe
ati2evxx.exe
clisvcl.exe
DefWatch.exe
hidserv.exe
NMSSvc.Exe
Rtvscan.exe
QCONSVC.EXE
regsvc.exe
mstask.exe
slpservice.exe
slpmonx.exe
stisvc.exe
WinMgmt.exe
mspmspsv.exe
svchost.exe
Wuser32.exe
SMSAPM32.exe
explorer.exe
QCWLICON.EXE
TPHKMGR.exe
prpcui.exe
AGRSMMSG.exe
PROMon.exe
SynTPLpr.exe
SynTPEnh.exe
realsched.exe
qttask.exe
launch32.exe
VPTray.exe
CitiVAN.exe
jusched.exe
services.exe
SMSMon32.exe
msnmsgr.exe
windgs.exe
tgcmd.exe
AcroTray.exe
IMGICON.EXE
slpcap.exe
HOTSYNC.EXE
sgmain.exe
sgbhp.exe
IEXPLORE.EXE
TPONSCR.exe
TpScrex.exe
nlnotes.exe
nhldaemn.exe
IEXPLORE.EXE
spywarescanner.

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Default_Page_URL http://greatsearch.biz/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page http://greatsearch.biz/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://greatsearch.biz/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

provider
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Default_Page_URL http://greatsearch.biz/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL about:blank
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page http://greatsearch.biz/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar about:blank
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://greatsearch.biz/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

Use Search Asst no
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst

User Stylesheet
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Styles\User Stylesheet


****************************************