Bazooka Adware and Spyware Scanner Log 513

****************************************
Bazooka Adware and Spyware Scanner v1.13.01
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 11:44:31.
OS: Windows NT 5.1
Database version: 2.070000
Database format version: 1.020000
Database date: 20040610
Current date: 2004-06-13 11:44


****************************************
Result when scanning:

BrowserAid 666.333.911 stlbdist.dll
http://www.kephyr.com/spywarescanner/library/browseraid/index.phtml

CommonName 452.457.950 {1E1B2879-88FF-11D2-8D96-D7ACAC95951F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D2-8D96-D7ACAC95951F}
http://www.kephyr.com/spywarescanner/library/commonname/index.phtml

CoolWebSearch 452.000.000 iedll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\iedll
http://www.kephyr.com/spywarescanner/library/coolwebsearch/index.phtml

CoolWebSearch 452.000.000 loader
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\loader
http://www.kephyr.com/spywarescanner/library/coolwebsearch/index.phtml

CoolWebSearch.DNSErr 456.000.000 %WinDir%\DNSErr.dll
C:\WINNT\DNSErr.dll
http://www.kephyr.com/spywarescanner/library/coolwebsearch.DNSErr/index.phtml

eZula 122.927.147 eZmmod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\eZmmod
http://www.kephyr.com/spywarescanner/library/ezula/index.phtml

eZula 122.927.149 eZmmod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\eZmmod
http://www.kephyr.com/spywarescanner/library/ezula/index.phtml

eZula 122.927.150 %SystemDir%\ezstub.exe
C:\WINNT\System32\\ezstub.exe
http://www.kephyr.com/spywarescanner/library/ezula/index.phtml

FastSeeker 423.990.000 {4CC0FAF8-6048-421C-9FE2-261A9ECE5F80}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4CC0FAF8-6048-421C-9FE2-261A9ECE5F80}
http://www.kephyr.com/spywarescanner/library/fastseeker/index.phtml

FastSeeker 423.990.000 {4CC0FAF8-6048-421C-9FE2-261A9ECE5F80}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4CC0FAF8-6048-421C-9FE2-261A9ECE5F80}
http://www.kephyr.com/spywarescanner/library/fastseeker/index.phtml

FastSeeker 423.990.001 %ProgramsDir%\FastSeeker\
C:\Program Files\FastSeeker\
http://www.kephyr.com/spywarescanner/library/fastseeker/index.phtml

HelpExpress 738.900.001 %ProgramsDir%\Alset\
C:\Program Files\Alset\
http://www.kephyr.com/spywarescanner/library/helpexpress/index.phtml

IEDriver 292.000.000 %SystemDir%\IEDriver\
C:\WINNT\System32\\IEDriver\
http://www.kephyr.com/spywarescanner/library/iedriver/index.phtml

Internet Optimizer 123.000.001 {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F7F808F0-6F7D-442C-93E3-4A4827C2E4C8}
http://www.kephyr.com/spywarescanner/library/internetoptimizer/index.phtml

Internet Optimizer 123.000.003 %ProgramsDir%\Internet Optimizer\
C:\Program Files\Internet Optimizer\
http://www.kephyr.com/spywarescanner/library/internetoptimizer/index.phtml

ISTBar 122.122.002 IST Service
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IST Service
http://www.kephyr.com/spywarescanner/library/istbar/index.phtml

ISTBar 122.122.004
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISTsvc\DisplayName
http://www.kephyr.com/spywarescanner/library/istbar/index.phtml

ISTBar 122.122.005
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISTbarISTbar\DisplayName
http://www.kephyr.com/spywarescanner/library/istbar/index.phtml

ISTBar 122.122.006
HKEY_CLASSES_ROOT\CLSID\{5F1ABCDB-A875-46c1-8345-B72A4567E486}\InprocServer32\ThreadingModel
http://www.kephyr.com/spywarescanner/library/istbar/index.phtml

ISTBar 122.122.007 %ProgramsDir%\ISTBar\
C:\Program Files\ISTBar\
http://www.kephyr.com/spywarescanner/library/istbar/index.phtml

ISTBar 122.122.008 {5F1ABCDB-A875-46c1-8345-B72A4567E486}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{5F1ABCDB-A875-46c1-8345-B72A4567E486}
http://www.kephyr.com/spywarescanner/library/istbar/index.phtml

MediaLoads 132.927.944
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaLoads Enhanced\DisplayName
http://www.kephyr.com/spywarescanner/library/medialoads/index.phtml

MediaLoads 132.927.945
HKEY_CLASSES_ROOT\CLSID\{85A702BA-EA8F-4B83-AA07-07A5186ACD7E}\InprocServer32\ThreadingModel
http://www.kephyr.com/spywarescanner/library/medialoads/index.phtml

MediaLoads 132.927.946 %ProgramsDir%\Support Software\
C:\Program Files\Support Software\
http://www.kephyr.com/spywarescanner/library/medialoads/index.phtml

MediaLoads 132.927.947 {85A702BA-EA8F-4B83-AA07-07A5186ACD7E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{85A702BA-EA8F-4B83-AA07-07A5186ACD7E}
http://www.kephyr.com/spywarescanner/library/medialoads/index.phtml

My Search Bar 777.777.778 c:\Program Files\MySearch\
c:\Program Files\MySearch\
http://www.kephyr.com/spywarescanner/library/mysearchbar/index.phtml

Peper Trojan 993.799.000 2SWZKN82R5K47C
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\2SWZKN82R5K47C
http://www.kephyr.com/spywarescanner/library/pepertrojan/index.phtml

PowerScan 070.000.000 Power Scan
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Power Scan
http://www.kephyr.com/spywarescanner/library/powerscan/index.phtml

SaveNow 090.090.091 %ProgramsDir%\Save\
C:\Program Files\Save\
http://www.kephyr.com/spywarescanner/library/savenow/index.phtml

SuperBar 090.090.002 c:\SuperBar Files\
c:\SuperBar Files\
http://www.kephyr.com/spywarescanner/library/superbar/index.phtml

SuperBar 090.090.003 {136A9D1D-1F4B-43D4-8359-6F2382449255}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{136A9D1D-1F4B-43D4-8359-6F2382449255}
http://www.kephyr.com/spywarescanner/library/superbar/index.phtml

Scbar 190.092.390 SearchEnhancement
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SearchEnhancement
http://www.kephyr.com/spywarescanner/library/scbar/index.phtml

Scbar 190.092.391 %ProgramsDir%\scbar\
C:\Program Files\scbar\
http://www.kephyr.com/spywarescanner/library/scbar/index.phtml

Scbar 190.092.392 {00041A26-7033-432C-94C7-6371DE343822}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00041A26-7033-432C-94C7-6371DE343822}
http://www.kephyr.com/spywarescanner/library/scbar/index.phtml

ShopNav 692.218.239 %ProgramsDir%\Srng\
C:\Program Files\Srng\
http://www.kephyr.com/spywarescanner/library/shopnav/index.phtml

Statblaster 432.888.001 %ProgramsDir%\Media\Media\
C:\Program Files\Media\Media\
http://www.kephyr.com/spywarescanner/library/statblaster/index.phtml

Twaintech 523.888.000 %WinDir%\twaintec.dll
C:\WINNT\twaintec.dll
http://www.kephyr.com/spywarescanner/library/twaintech/index.phtml

Twaintech 523.888.001 {000020DD-C72E-4113-AF77-DD56626C6C42}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000020DD-C72E-4113-AF77-DD56626C6C42}
http://www.kephyr.com/spywarescanner/library/twaintech/index.phtml

WeatherCast 342.000.000 WeatherCast
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WeatherCast
http://www.kephyr.com/spywarescanner/library/weathercast/index.phtml

WeatherCast 342.000.001 %ProgramsDir%\WeatherCast\
C:\Program Files\WeatherCast\
http://www.kephyr.com/spywarescanner/library/weathercast/index.phtml

WebHancer 888.333.111 webHancer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\webHancer Agent
http://www.kephyr.com/spywarescanner/library/webhancer/index.phtml

WebHancer 888.333.111 webHancer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\webHancer Survey Companion
http://www.kephyr.com/spywarescanner/library/webhancer/index.phtml

WebHancer 321.123.321
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent\DisplayName
http://www.kephyr.com/spywarescanner/library/webhancer/index.phtml

WebHancer 321.123.322 %Windir%\whInstaller.exe
C:\WINNT\whInstaller.exe
http://www.kephyr.com/spywarescanner/library/webhancer/index.phtml

WebHancer 321.123.323 {c900b400-cdfe-11d3-976a-00e02913a9e0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0}
http://www.kephyr.com/spywarescanner/library/webhancer/index.phtml

WebSavings 523.900.001 %ProgramsDir%\WebSavingsfromEbates\
C:\Program Files\WebSavingsfromEbates\
http://www.kephyr.com/spywarescanner/library/websavings/index.phtml

****************************************
Auto start entries:
C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\desktop.ini
C:\Program Files\Hewlett-Packard\LaserJet 33xx\hppdirector.exe
C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
C:\Program Files\Hewlett-Packard\LaserJet 33xx\hppdirector.exe
C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\desktop.ini
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\desktop.ini

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
IgfxTray C:\WINNT\System32\igfxtray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IgfxTray

HotKeysCmds C:\WINNT\System32\hkcmd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HotKeysCmds

Hot Key Kbd 9910 Daemon SK9910DM.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Hot Key Kbd 9910 Daemon

GWMDMMSG GWMDMMSG.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\GWMDMMSG

Keyboard Preload Check C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Keyboard Preload Check

GWMDMpi C:\WINNT\GWMDMpi.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\GWMDMpi

Gateway Ink Monitor "C:\Program Files\Gateway Utilities\GWInkMonitor.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Gateway Ink Monitor

AdaptecDirectCD "c:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AdaptecDirectCD

MMTray C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MMTray

Power Scan C:\Program Files\Power Scan\powerscan.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Power Scan

2SWZKN82R5K47C C:\WINNT\System32\Cyf0o.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\2SWZKN82R5K47C

Srng \Program Files\Srng\Srng.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Srng

ccRegVfy "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ccRegVfy

ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ccApp

Microsoft Works Update Detection C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Works Update Detection

HP SchedIndexer C:\Program Files\Hewlett-Packard\LaserJet 33xx\hppschedindexer.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP SchedIndexer

HP AutoIndexer C:\Program Files\Hewlett-Packard\LaserJet 33xx\hppautoindexer.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP AutoIndexer

mmtask C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\mmtask

SearchEnhancement "C:\Program Files\scbar\v9\scbar.exe" /H
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SearchEnhancement

TV Media C:\Program Files\TV Media\Tvm.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TV Media

bicfbtwb C:\WINNT\hxqdmdmid.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\bicfbtwb

webHancer Agent "C:\Program Files\webHancer\Programs\whAgent.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\webHancer Agent

webHancer Survey Companion "C:\Program Files\webHancer\Programs\whSurvey.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\webHancer Survey Companion

zxcnfhekq C:\WINNT\System32\qzxepd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\zxcnfhekq

IST Service C:\Program Files\ISTsvc\istsvc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IST Service

TV Media C:\Program Files\TV Media\Tvm.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\TV Media

MSMSGS "C:\Program Files\Messenger\msmsgs.exe" /background
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS

MoneyAgent "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MoneyAgent

ctfmon.exe C:\WINNT\System32\ctfmon.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe

iedll C:\Program Files\Windows Media Player\iedll.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\iedll

loader C:\Program Files\Windows Media Player\wmplayer.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\loader

AIM C:\Program Files\AIM\aim.exe -cnetwait.odl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AIM

eZmmod C:\PROGRA~1\ezula\mmod.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\eZmmod

TV Media C:\Program Files\TV Media\Tvm.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\TV Media

WeatherCast C:\PROGRA~1\WEATHE~1\Weather.exe /q
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WeatherCast

TV Media C:\Program Files\TV Media\Tvm.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\TV Media


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{000020DD-C72E-4113-AF77-DD56626C6C42} not set C:\WINNT\twaintec.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000020DD-C72E-4113-AF77-DD56626C6C42}

{00041A26-7033-432C-94C7-6371DE343822} not set C:\Program Files\scbar\v9\scbar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00041A26-7033-432C-94C7-6371DE343822}

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{136A9D1D-1F4B-43D4-8359-6F2382449255} not set C:\Program Files\_SUPERBAR\_SUPERBAR.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{136A9D1D-1F4B-43D4-8359-6F2382449255}

{1E1B2879-88FF-11D2-8D96-D7ACAC95951F} DNSErr object C:\WINNT\DNSErr.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D2-8D96-D7ACAC95951F}

{243B17DE-77C7-46BF-B94B-0B5F309A0E64} not set C:\Program Files\Microsoft Money\System\mnyside.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}

{28BD8780-1A54-48DB-BB88-51028C93D277} not set C:\WINNT\System32\aekfpixguid.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28BD8780-1A54-48DB-BB88-51028C93D277}

{85A702BA-EA8F-4B83-AA07-07A5186ACD7E} Support Software C:\Program Files\Support Software\SS2.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{85A702BA-EA8F-4B83-AA07-07A5186ACD7E}

{BDF3E430-B101-42AD-A544-FADC6B084872} NAV Helper C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}

{c900b400-cdfe-11d3-976a-00e02913a9e0} not set C:\Program Files\webHancer\programs\whiehlpr.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0}

{F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} not set C:\WINNT\nem218.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F7F808F0-6F7D-442C-93E3-4A4827C2E4C8}

{FDD3B846-8D59-4ffb-8758-209B6AD74ACC} not set Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

{FE195279-560E-750A-0C70-BAACD31811FB} not set C:\PROGRA~1\WMABIB~1\MEMO BROWSE.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE195279-560E-750A-0C70-BAACD31811FB}


****************************************
Toolbars:

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINNT\System32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{4F58E52B-DD52-472E-B91B-2540C629232B} C:\Program Files\_SUPERBAR\_SUPERBAR.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4F58E52B-DD52-472E-B91B-2540C629232B}

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}

{4CC0FAF8-6048-421C-9FE2-261A9ECE5F80} C:\PROGRA~1\FASTSE~1\FASTSE~2.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4CC0FAF8-6048-421C-9FE2-261A9ECE5F80}

{FAE1782D-201C-DFCA-D7FB-5B070F8179D2} C:\PROGRA~1\WMABIB~1\MEMO BROWSE.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{FAE1782D-201C-DFCA-D7FB-5B070F8179D2}

{5F1ABCDB-A875-46c1-8345-B72A4567E486} C:\Program Files\ISTbar\istbar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{5F1ABCDB-A875-46c1-8345-B72A4567E486}

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINNT\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINNT\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{5F1ABCDB-A875-46C1-8345-B72A4567E486} C:\Program Files\ISTbar\istbar.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5F1ABCDB-A875-46C1-8345-B72A4567E486}

{4F58E52B-DD52-472E-B91B-2540C629232B} C:\Program Files\_SUPERBAR\_SUPERBAR.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4F58E52B-DD52-472E-B91B-2540C629232B}

{4CC0FAF8-6048-421C-9FE2-261A9ECE5F80} C:\PROGRA~1\FASTSE~1\FASTSE~2.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4CC0FAF8-6048-421C-9FE2-261A9ECE5F80}

{FAE1782D-201C-DFCA-D7FB-5B070F8179D2} C:\PROGRA~1\WMABIB~1\MEMO BROWSE.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{FAE1782D-201C-DFCA-D7FB-5B070F8179D2}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINNT\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} C:\WINNT\System32\Shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}

{32683183-48a0-441b-a342-7c2a440a9478} C:\WINNT\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}

{EFA24E61-B078-11D0-89E4-00C04FC9E26E} C:\WINNT\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}

{EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINNT\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}


****************************************
All processes:

[System Process]
System
smss.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
ccEvtMgr.exe
NISUM.EXE
explorer.exe
hkcmd.exe
SK9910DM.EXE
GWMDMMSG.exe
GWInkMonitor.exe
Directcd.exe
mm_tray.exe
Srng.exe
ccApp.exe
WkUFind.exe
mmtask.exe
hxqdmdmid.exe
whAgent.exe
whSurvey.exe
qzxepd.exe
istsvc.exe
msmsgs.exe
ctfmon.exe
aim.exe
mmod.exe
Weather.exe
hppdirector.exe
hppapml0.exe
CCPXYSVC.EXE
mdm.exe
Navapsvc.exe
svchost.exe
spywarescanner.exe
ntvdm.exe

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

http://search.windowenhancer.com/nph-search.cgi?affid=sesm1&look=stmpl1&sstring=
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\

Default_Page_URL http://www.gateway.net
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://search.windowenhancer.com/nph-search.cgi?affid=sesm1&look=stmpl1&sstring=
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page C:\WINNT\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://search.windowenhancer.com/nph-search.cgi?affid=sesbar1&look=sbar1_srchbtn
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://search.shopnav.com/apps/epa/epa?cid=shnv9886&s=
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://www.gateway.net
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://www.shopnav.com/search/9886/search.html
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

http://search.windowenhancer.com/nph-search.cgi?affid=sesm1&look=stmpl1&sstring=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\

provider msn
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Local Page C:\WINNT\System32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://www.shopnav.com/search/9886/search.html
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://search.shopnav.com/apps/epa/epa?cid=shnv9886&s=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page about:blank
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

Use Search Asst no
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst

SearchAssistant http://search.windowenhancer.com/nph-search.cgi?affid=sesm1&look=stmpl1&sstring=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant


****************************************