**************************************** Bazooka Adware and Spyware Scanner v1.13.01 http://www.kephyr.com/spywarescanner/ http://www.kephyr.com/spywarescanner/library/ Log created 20:28:21. OS: Windows NT 5.1 Database version: 2.100000 Database format version: 1.020000 Database date: 20040623 Current date: 2004-06-28 20:28 **************************************** Result when scanning: MS Media Player GUID 404.888.000 HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Settings\Client ID http://www.kephyr.com/spywarescanner/library/msmediaplayerguid/index.phtml **************************************** Auto start entries: C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe "-run_only_if_connected" "-auto_initiation" C:\Documents and Settings\All Users\Menu D�marrer\Programmes\D�marrage\desktop.ini C:\WINDOWS\system32\RAMASST.exe C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe "-run_only_if_connected" "-auto_initiation" C:\Documents and Settings\All Users\Menu D�marrer\Programmes\D�marrage\desktop.ini C:\WINDOWS\system32\RAMASST.exe C:\Documents and Settings\Nicolas Fr�ve\Menu D�marrer\Programmes\D�marrage\desktop.ini C:\Documents and Settings\Nicolas Fr�ve\Menu D�marrer\Programmes\D�marrage\PowerReg Scheduler.exe C:\Documents and Settings\Nicolas Fr�ve\Menu D�marrer\Programmes\D�marrage\desktop.ini C:\Documents and Settings\Nicolas Fr�ve\Menu D�marrer\Programmes\D�marrage\PowerReg Scheduler.exe Go here to analyse the startup entries and the associated files: http://www.kephyr.com/filedb/index.php **************************************** Run entries: NvCplDaemon RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon nwiz nwiz.exe /install HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\nwiz BackgroundSwitcher C:\WINDOWS\System32\bgswitch.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\BackgroundSwitcher CoolSwitch C:\WINDOWS\System32\taskswitch.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CoolSwitch FastUser C:\WINDOWS\System32\fast.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\FastUser WinVNC "C:\Program Files\ORL\VNC\WinVNC.exe" -servicehelper HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WinVNC HPDJ Taskbar Utility C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HPDJ Taskbar Utility AdaptecDirectCD C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AdaptecDirectCD QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task IW Controlcenter C:\PROGRA~1\VOB\INSTAN~1\IWCTRL.EXE HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IW Controlcenter B'sCLiP C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\B'sCLiP TkBellExe "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TkBellExe HPHUPD05 C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HPHUPD05 HP Component Manager "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP Component Manager HPHmon05 C:\WINDOWS\System32\hphmon05.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HPHmon05 ccApp "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ccApp Multimedia Codecs C:\WINDOWS\System32\mcc.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Codecs msse32.exe C:\WINDOWS\msse32.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\msse32.exe crom.exe C:\WINDOWS\system32\crom.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\crom.exe MSMSGS "C:\Program Files\Messenger\msmsgs.exe" /background HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS NvMediaCenter RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\NvMediaCenter PopupSleuth C:\Program Files\Popup Sleuth\Popup Sleuth.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\PopupSleuth SpyKiller C:\Program Files\SpyKiller\spykiller.exe /startup HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SpyKiller Go here to analyse the run entries and the associated files: http://www.kephyr.com/filedb/index.php **************************************** Browser helper objects: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} {0B908CAD-3C8E-F8BB-BABB-D566F522D77D} C:\WINDOWS\netvy32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B908CAD-3C8E-F8BB-BABB-D566F522D77D} {BDF3E430-B101-42AD-A544-FADC6B084872} NAV Helper C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872} **************************************** Toolbars: {8E718888-423F-11D2-876E-00A0C9082467} C:\WINDOWS\System32\msdxm.ocx HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467} {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} {01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} {0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\system32\SHELL32.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} {4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINDOWS\System32\shdocvw.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} {30D02401-6A81-11D0-8274-00C04FD5AE38} C:\WINDOWS\System32\browseui.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38} {32683183-48a0-441b-a342-7c2a440a9478} C:\WINDOWS\System32\browseui.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} {C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} C:\WINDOWS\system32\SHELL32.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} {EFA24E61-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E} {EFA24E62-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E} {EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E} **************************************** All processes: [System Process] System smss.exe csrss.exe winlogon.exe services.exe lsass.exe svchost.exe svchost.exe svchost.exe svchost.exe ccSetMgr.exe ccEvtMgr.exe spoolsv.exe cvpnd.exe DVDRAMSV.exe NAVAPSVC.EXE nvsvc32.exe SAVSCAN.EXE svchost.exe Fast.exe explorer.exe crom.exe TaskSwitch.exe hpztsb09.exe Directcd.exe qttask.exe iwctrl.exe BsCLiP.exe realsched.exe hphmon05.exe ccApp.exe msse32.exe msmsgs.exe rundll32.exe Popup Sleuth.exe RAMASST.exe HPZipm12.exe spywarescanner.exe Go here to analyse the running processes: http://www.kephyr.com/filedb/index.php **************************************** Internet Explorer Settings: Search http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search Default_Page_URL res://fnuyy.dll/index.html#27063 HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL Default_Search_URL res://C:\WINDOWS\fnuyy.dll/sp.html#27063 HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL Local Page C:\WINDOWS\system32\blank.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page Search Page res://C:\WINDOWS\fnuyy.dll/sp.html#27063 HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page Start Page res://fnuyy.dll/index.html#27063 HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page Use Search Asst no HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Use Search Asst SearchAssistant http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant CustomizeSearch http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch http:// HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\ www http:// HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www Search http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search provider HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider Default_Page_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL Local Page C:\WINDOWS\System32\blank.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page Search Bar HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar Search Page res://C:\WINDOWS\fnuyy.dll/sp.html#27063 HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page Start Page res://fnuyy.dll/index.html#27063 HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page Use Search Asst no HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst SearchAssistant http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant CustomizeSearch http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\CustomizeSearch ****************************************
