Bazooka Adware and Spyware Scanner Log 521

****************************************
Bazooka Adware and Spyware Scanner v1.13.01
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 19:52:43.
OS: Windows NT 5.1
Database version: 2.070000
Database format version: 1.020000
Database date: 20040610
Current date: 2004-06-12 19:52


****************************************
Result when scanning:

Apropos 341.001.000 c:\Program Files\AutoUpdate\
c:\Program Files\AutoUpdate\
http://www.kephyr.com/spywarescanner/library/apropos/index.phtml

Apropos 341.001.001 AutoUpdater
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AutoUpdater
http://www.kephyr.com/spywarescanner/library/apropos/index.phtml

Apropos.bho 342.001.000 {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01C5BF6C-E699-4CD7-BEA1-786FA05C83AB}
http://www.kephyr.com/spywarescanner/library/apropos.bho/index.phtml

BrowserAid 666.333.987 {2CF0B992-5EEB-4143-99C0-5297EF71F444}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\{2CF0B992-5EEB-4143-99C0-5297EF71F444}
http://www.kephyr.com/spywarescanner/library/browseraid/index.phtml

BrowserAid 666.333.911 stlbdist.dll
http://www.kephyr.com/spywarescanner/library/browseraid/index.phtml

BrowserAid 666.333.912 {2CF0B992-5EEB-4143-99C0-5297EF71F443}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2CF0B992-5EEB-4143-99C0-5297EF71F443}
http://www.kephyr.com/spywarescanner/library/browseraid/index.phtml

BrowserAid.Rundll 667.333.000 RunWindowsUpdate
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\RunWindowsUpdate
http://www.kephyr.com/spywarescanner/library/browseraid.rundll/index.phtml

ClearSearch.csie 729.978.000 {00000000-0000-0000-0000-000000000221}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-0000-0000-0000-000000000221}
http://www.kephyr.com/spywarescanner/library/clearsearch.csie/index.phtml

ClearSearch.csie 729.978.001 %ProgramsDir%\ClearSearch\CSIE.DLL
C:\Program Files\ClearSearch\CSIE.DLL
http://www.kephyr.com/spywarescanner/library/clearsearch.csie/index.phtml

ClockSync 847.700.000 ClockSync
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ClockSync
http://www.kephyr.com/spywarescanner/library/clocksync/index.phtml

ClockSync 847.700.001 %ProgramsDir%\ClockSync\
C:\Program Files\ClockSync\
http://www.kephyr.com/spywarescanner/library/clocksync/index.phtml

IEDriver 292.000.000 %SystemDir%\IEDriver\
C:\WINDOWS\System32\\IEDriver\
http://www.kephyr.com/spywarescanner/library/iedriver/index.phtml

IEDriver 292.000.001 IEDriver
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IEDriver
http://www.kephyr.com/spywarescanner/library/iedriver/index.phtml

IGetNet 192.198.888 ClrSchLoader
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ClrSchLoader
http://www.kephyr.com/spywarescanner/library/igetnet/index.phtml

IGetNet 692.118.540 %ProgramsDir%\ClearSearch\
C:\Program Files\ClearSearch\
http://www.kephyr.com/spywarescanner/library/igetnet/index.phtml

ISTBar 122.122.001 AutoUpdater
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AutoUpdater
http://www.kephyr.com/spywarescanner/library/istbar/index.phtml

KeenValue.updmgr 644.000.000 updmgr
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\updmgr
http://www.kephyr.com/spywarescanner/library/keenvalue.updmgr/index.phtml

KeenValue.updmgr 644.000.001 %ProgramsDir%\Common Files\updmgr\
C:\Program Files\Common Files\updmgr\
http://www.kephyr.com/spywarescanner/library/keenvalue.updmgr/index.phtml

MemoryWatcher 654.777.000 %ProgramsDir%\MemoryWatcher\
C:\Program Files\MemoryWatcher\
http://www.kephyr.com/spywarescanner/library/memorywatcher/index.phtml

My Search Bar 777.777.778 c:\Program Files\MyWay\
c:\Program Files\MyWay\
http://www.kephyr.com/spywarescanner/library/mysearchbar/index.phtml

Peper Trojan 993.799.000 2P6WFAX43ZHE7C
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\2P6WFAX43ZHE7C
http://www.kephyr.com/spywarescanner/library/pepertrojan/index.phtml

PromulGate 837.700.000 Dpi
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Dpi
http://www.kephyr.com/spywarescanner/library/promulgate/index.phtml

PromulGate 837.700.001 %ProgramsDir%\Common Files\Dpi\
C:\Program Files\Common Files\Dpi\
http://www.kephyr.com/spywarescanner/library/promulgate/index.phtml

PromulGate.pcsvc 434.700.000 Pcsv
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Pcsv
http://www.kephyr.com/spywarescanner/library/promulgate.pcsvc/index.phtml

PromulGate.pcsvc 434.700.001 %SystemDir%\pcs\
C:\WINDOWS\System32\\pcs\
http://www.kephyr.com/spywarescanner/library/promulgate.pcsvc/index.phtml

SaveNow 090.090.090 WhenUSave
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WhenUSave
http://www.kephyr.com/spywarescanner/library/savenow/index.phtml

SaveNow 555.666.777 Save.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WhenUSave
http://www.kephyr.com/spywarescanner/library/savenow/index.phtml

SaveNow 090.090.091 %ProgramsDir%\Save\
C:\Program Files\Save\
http://www.kephyr.com/spywarescanner/library/savenow/index.phtml

SearchPage.cc 324.343.000 %SystemDir%\mshelper.dll
C:\WINDOWS\System32\\mshelper.dll
http://www.kephyr.com/spywarescanner/library/searchpage.cc/index.phtml

Twaintech 523.888.000 %WinDir%\twaintec.dll
C:\WINDOWS\twaintec.dll
http://www.kephyr.com/spywarescanner/library/twaintech/index.phtml

Twaintech 523.888.001 {000020DD-C72E-4113-AF77-DD56626C6C42}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000020DD-C72E-4113-AF77-DD56626C6C42}
http://www.kephyr.com/spywarescanner/library/twaintech/index.phtml

****************************************
Auto start entries:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
C:\Program Files\Portrait Displays\MagicTune\DTHtml.exe -startup_folder
C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe -boot
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
C:\Program Files\Portrait Displays\MagicTune\DTHtml.exe -startup_folder
C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe -boot
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\desktop.ini
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Paltalk\pnetaware.exe
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\desktop.ini
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Paltalk\pnetaware.exe

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
P2P Networking C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\P2P Networking

Verizon Control Pad C:\Program Files\Verizon Online\ControlPad\cpad.exe #SPLASH
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Verizon Control Pad

TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TkBellExe

SynTPLpr C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SynTPLpr

SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SynTPEnh

Samsung LBP SM "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Samsung LBP SM

QT4HPOT C:\PROGRA~1\HEWLET~1\ONE-TO~1\OneTouch.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QT4HPOT

PreloadApp c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PreloadApp

PowerDirector C:\WINDOWS\Temp\TPDIR\setup.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PowerDirector

NAV Agent C:\PROGRA~1\NORTON~1\navapw32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NAV Agent

Motive SmartBridge C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Motive SmartBridge

MessengerPlus2 "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MessengerPlus2

IPInSightMonitor 01 "C:\Program Files\Verizon Online\VisualIPInsight\IPMon32.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IPInSightMonitor 01

IPInSightLAN 01 "C:\Program Files\Verizon Online\VisualIPInsight\IPClient.exe" -l
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IPInSightLAN 01

IEDriver C:\WINDOWS\System32\IEDriver\IEDriver.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IEDriver

hpsysdrv c:\windows\system\hpsysdrv.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\hpsysdrv

hpScannerFirstBoot c:\hp\drivers\scanners\scannerfb.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\hpScannerFirstBoot

HP TV Now C:\Program Files\Hewlett-Packard\HP TV Now\HpTvNow.exe /RK
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP TV Now

hp Silent Service C:\Windows\system32\HpSrvUI.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\hp Silent Service

HP Presentation Ready C:\Program Files\Hewlett-Packard\HP Presentation Ready\PresRdy.exe -r
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP Presentation Ready

HP Display Settings C:\Program Files\Hewlett-Packard\HP Notebook Utilities\hptasks.exe /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP Display Settings

dla C:\WINDOWS\system32\dla\tfswctrl.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\dla

CARPService carpserv.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CARPService

AtiPTA atiptaxx.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AtiPTA

ATIModeChange Ati2mdxx.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ATIModeChange

h2dyA1H C:\documents and settings\owner\local settings\temp\h2dyA1H.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\h2dyA1H

yuyHMYOyy C:\documents and settings\owner\local settings\temp\yuyHMYOyy.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\yuyHMYOyy

ClrSchLoader C:\Program Files\ClearSearch\Loader.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ClrSchLoader

Bakra C:\WINDOWS\System32\IEHost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Bakra

2P6WFAX43ZHE7C C:\WINDOWS\System32\Yfk8.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\2P6WFAX43ZHE7C

{2CF0B992-5EEB-4143-99C0-5297EF71F444} rundll32.exe C:\WINDOWS\System32\stlbdist.DLL,DllRunMain
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\{2CF0B992-5EEB-4143-99C0-5297EF71F444}

RunWindowsUpdate C:\WINDOWS\uptodate.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\RunWindowsUpdate

WhenUSave C:\Program Files\Save\Save.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WhenUSave

azqzrvzguashn C:\WINDOWS\System32\jziurx.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\azqzrvzguashn

x76X3EX tsspnsp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\x76X3EX

AutoUpdater "C:\Program Files\AutoUpdate\AutoUpdate.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AutoUpdater

Pcsv C:\WINDOWS\system32\pcs\pcsvc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Pcsv

Dpi C:\Program Files\Common Files\Dpi\dpi.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Dpi

updmgr C:\Program Files\Common files\updmgr\updmgr.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\updmgr

ctfmon.exe C:\WINDOWS\System32\ctfmon.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe

Yahoo! Pager C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo! Pager

Symantec NetDriver Monitor C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Symantec NetDriver Monitor

H/PC Connection Agent "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\H/PC Connection Agent

ClockSync C:\PROGRA~1\CLOCKS~1\Sync.exe /q
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ClockSync

gwp7RObnS uicace.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\gwp7RObnS


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{00000000-0000-0000-0000-000000000221} IE Agent C:\Program Files\ClearSearch\CSIE.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-0000-0000-0000-000000000221}

{000020DD-C72E-4113-AF77-DD56626C6C42} not set C:\WINDOWS\twaintec.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000020DD-C72E-4113-AF77-DD56626C6C42}

{01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} not set C:\Program Files\SysAI\AproposPlugin.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01C5BF6C-E699-4CD7-BEA1-786FA05C83AB}

{02478D38-C3F9-4efb-9B51-7695ECA05670} not set C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{2CF0B992-5EEB-4143-99C0-5297EF71F443} not set C:\WINDOWS\System32\stlbdist.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2CF0B992-5EEB-4143-99C0-5297EF71F443}

{4FC95EDD-4796-4966-9049-29649C80111D} NavErrRedir Class C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4FC95EDD-4796-4966-9049-29649C80111D}

{5ADA9CAC-04F9-4DD2-ABFD-74D673BE8624} not set C:\WINDOWS\_MWOLTB.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5ADA9CAC-04F9-4DD2-ABFD-74D673BE8624}

{AA58ED58-01DD-4d91-8333-CF10577473F7} not set c:\windows\googletoolbar1.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}

{b5b393ee-6968-4cab-a3dc-8e80ed9ecb83} not set Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{b5b393ee-6968-4cab-a3dc-8e80ed9ecb83}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b5b393ee-6968-4cab-a3dc-8e80ed9ecb83}

{BDF3E430-B101-42AD-A544-FADC6B084872} not set C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}

{C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} not set C:\Program Files\SEP\sep.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5183ABC-EB6E-4E05-B8C9-500A16B6CF94}


****************************************
Toolbars:

{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} C:\HP\EXPLOREBAR\HPTOOLKT.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINDOWS\System32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{B7B76DD6-B6F0-4443-AF81-6A3ECF12A57D} C:\WINDOWS\_MWOLTB.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B7B76DD6-B6F0-4443-AF81-6A3ECF12A57D}

{2318C2B1-4965-11d4-9B18-009027A5CD4F} c:\windows\googletoolbar1.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{2318C2B1-4965-11d4-9B18-009027A5CD4F}

{EF99BD32-C1FB-11D2-892F-0090271D4F88} C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

{C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} C:\Program Files\SEP\sep.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{C5183ABC-EB6E-4E05-B8C9-500A16B6CF94}

{2CF0B992-5EEB-4143-99C0-5297EF71F444} C:\WINDOWS\System32\stlbdist.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{2CF0B992-5EEB-4143-99C0-5297EF71F444}

{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} C:\HP\EXPLOREBAR\HPTOOLKT.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}

{2318C2B1-4965-11D4-9B18-009027A5CD4F} c:\windows\googletoolbar1.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{EF99BD32-C1FB-11D2-892F-0090271D4F88} C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

{E13D9A89-5CE1-42C6-AB8E-19ED063BDEDA} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{E13D9A89-5CE1-42C6-AB8E-19ED063BDEDA}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{E13D9A89-5CE1-42C6-AB8E-19ED063BDEDA}

{6A084CFB-01AE-48E9-95E1-EB0C6A4BDB76} C:\DOCUME~2\Owner\APPLIC~1\lldroccheie.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{6A084CFB-01AE-48E9-95E1-EB0C6A4BDB76}

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}

{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} C:\HP\EXPLOREBAR\HPTOOLKT.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}

{35D9949E-9BA7-4B36-9AA9-5FB524BD901D} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{35D9949E-9BA7-4B36-9AA9-5FB524BD901D}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{35D9949E-9BA7-4B36-9AA9-5FB524BD901D}

{2318C2B1-4965-11D4-9B18-009027A5CD4F} c:\windows\googletoolbar1.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

{B7B76DD6-B6F0-4443-AF81-6A3ECF12A57D} C:\WINDOWS\_MWOLTB.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B7B76DD6-B6F0-4443-AF81-6A3ECF12A57D}

{2CF0B992-5EEB-4143-99C0-5297EF71F444} C:\WINDOWS\System32\stlbdist.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{2CF0B992-5EEB-4143-99C0-5297EF71F444}

{4528BBE0-4E08-11D5-AD55-00010333D0AD} C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINDOWS\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{8F4902B6-6C04-4ade-8052-AA58578A21BD} C:\WINDOWS\System32\Shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{8F4902B6-6C04-4ade-8052-AA58578A21BD}

{32683183-48a0-441b-a342-7c2a440a9478} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}

{4528BBE0-4E08-11D5-AD55-00010333D0AD} C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}

{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}

{EFA24E61-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}

{EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}


****************************************
All processes:

[System Process]
System
smss.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
ati2evxx.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
alg.exe
HPConfig.exe
Navapsvc.exe
RadioSvr.exe
svchost.exe
explorer.exe
ctfmon.exe
P2P Networking.exe
realsched.exe
SynTPLpr.exe
SynTPEnh.exe
ONETOUCH.EXE
Navapw32.exe
MotiveSB.exe
ipmon32.exe
IPClient.exe
IEDRIVER.EXE
hpsysdrv.exe
HpSrvUI.exe
hptasks.exe
tfswctrl.exe
carpserv.exe
atiptaxx.exe
h2dyA1H.exe
yuyHMYOyy.exe
Loader.exe
IEHost.EXE
rundll32.exe
uptodate.EXE
Save.exe
jziurx.exe
tsspnsp.exe
AutoUpdate.exe
pcsvc.exe
dpi.exe
updmgr.exe
wcescomm.exe
Sync.exe
uicace.exe
SysAI.exe
cmd.exe
spywarescanner.exe
LkhAX92.exe
Rqe8me4U.exe
Rqe8me4U.exe

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Search http://%6E%6B%76%64%2E%75%73
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search

Default_Page_URL http://www.hp.com/info/e-center-p
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://%6E%6B%76%64%2E%75%73
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page C:\WINDOWS\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://srch-us4nb.hpwis.com/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://%6E%6B%76%64%2E%75%73
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://%6E%6B%76%64%2E%75%73
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://%6E%6B%76%64%2E%75%73
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://%6E%6B%76%64%2E%75%73
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://%6E%6B%76%64%2E%75%73/
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://%6E%6B%76%64%2E%75%73/
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

Search http://%6E%6B%76%64%2E%75%73
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search

http://home.microsoft.com/access/autosearch.asp?p=%s
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\

provider
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Default_Page_URL http://%6E%6B%76%64%2E%75%73
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://%6E%6B%76%64%2E%75%73
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page C:\WINDOWS\System32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://%6E%6B%76%64%2E%75%73
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://%6E%6B%76%64%2E%75%73
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://%6E%6B%76%64%2E%75%73
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

Use Search Asst yes
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst

SearchAssistant http://%6E%6B%76%64%2E%75%73
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://%6E%6B%76%64%2E%75%73
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\CustomizeSearch


****************************************