**************************************** Bazooka Adware and Spyware Scanner v1.13.01 http://www.kephyr.com/spywarescanner/ http://www.kephyr.com/spywarescanner/library/ Log created 11:30:54. OS: Windows NT 5.0 Database version: 2.040000 Database format version: 1.020000 Database date: 20040518 Current date: 2004-05-20 11:30 **************************************** Result when scanning: WinDir.winlogon 948.222.000 %WinDir%\winlogon.exe C:\WINNT\winlogon.exe http://www.kephyr.com/spywarescanner/library/windir.winlogon/index.phtml **************************************** Auto start entries: C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Go here to analyse the startup entries and the associated files: http://www.kephyr.com/filedb/index.php **************************************** Run entries: HP Software Update "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP Software Update HP Component Manager "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP Component Manager Iesearch.exe C:\Program Files\Internet Explorer\Iesearch.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Iesearch.exe mswspl C:\WINNT\tmng.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\mswspl Windows Shell Library Loader load shell32.dll /c /set HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Windows Shell Library Loader winlogon c:\winnt\winlogon.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\winlogon Go here to analyse the run entries and the associated files: http://www.kephyr.com/filedb/index.php **************************************** Browser helper objects: **************************************** Toolbars: {8E718888-423F-11D2-876E-00A0C9082467} C:\WINNT\System32\msdxm.ocx HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467} {01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINNT\System32\browseui.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} {0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINNT\System32\browseui.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} {01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINNT\System32\browseui.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} {0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINNT\System32\browseui.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} {4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINNT\System32\shdocvw.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} {C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} C:\WINNT\system32\shell32.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} {EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINNT\System32\browseui.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E} **************************************** All processes: System SMSS.EXE CSRSS.EXE WINLOGON.EXE SERVICES.EXE LSASS.EXE svchost.exe spoolsv.exe msdtc.exe tcpsvcs.exe svchost.exe LLSSRV.EXE sfmprint.exe regsvc.exe mstask.exe SNMP.EXE stisvc.exe WinMgmt.exe WINS.EXE svchost.exe dfssvc.exe DNS.EXE explorer.exe inetinfo.exe SFMSVC.EXE hpwuSchd.exe hpcmpmgr.exe Iesearch.exe hpqtra08.exe hptskmgr.exe HPZipm12.exe svchost.exe wuauclt.exe tmng.exe DLLHOST.EXE DLLHOST.EXE mdm.exe tmng.exe winlogon.exe spywarescanner. IEXPLORE.EXE Go here to analyse the running processes: http://www.kephyr.com/filedb/index.php **************************************** Internet Explorer Settings: Local Page C:\WINNT\system32\blank.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page Start Page about:blank HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page Use Search Asst no HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Use Search Asst SearchAssistant http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant CustomizeSearch http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch http:// HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\ www http:// HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www provider gogl HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider Local Page C:\WINNT\system32\blank.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page Start Page http://www.yahoo.com/ HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page Use Search Asst no HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst http://%31%2D%73%65%2E%63%6F%6D/%73%72%63%68%61%73%73%74%2E%68%74%6D%6C HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\ ****************************************
