Bazooka Adware and Spyware Scanner Log 99

Bazooka Adware and Spyware Scanner Log 99

****************************************
Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 08:26:45.
OS: Windows NT 5.0
Database version: 1.830000
Database format version: 1.020000
Database date: 20040227
Current date: 2004-03-01 08:26

****************************************
Result when scanning:

General Virus, Worm, Trojan 294.000.004 LTM2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\LTM2
http://www.kephyr.com/spywarescanner/library/generalvirus/index.phtml

****************************************
Auto start entries:
C:\Program Files\iM Networks\iM Radio Tuner\iM_Tray.exe
F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
F:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l
F:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
F:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\iM Networks\iM Radio Tuner\iM_Tray.exe
F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
F:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l
F:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
F:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\desktop weather\desktopweather_1309264.exe
F:\Program Files\Clie\Sony Handheld\HOTSYNC.EXE
F:\Program Files\Trillian\trillian.exe
C:\Program Files\desktop weather\desktopweather_1309264.exe
F:\Program Files\Clie\Sony Handheld\HOTSYNC.EXE
F:\Program Files\Trillian\trillian.exe

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
Synchronization Manager mobsync.exe /logon
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Synchronization Manager

Promon.exe Promon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Promon.exe

NvCplDaemon RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon

nwiz nwiz.exe /install
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\nwiz

CTHelper CTHELPER.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CTHelper

ADUserMon C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ADUserMon

Iomega Drive Icons F:\Program Files\Iomega\DriveIcons\ImgIcon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Iomega Drive Icons

Deskup F:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Deskup

PrinTray C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PrinTray

QuickTime Task "F:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task

dla C:\WINNT\system32\dla\tfswctrl.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\dla

NeroFilterCheck C:\WINNT\system32\NeroCheck.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NeroFilterCheck

AtomTime "C:\Program Files\AtomTime Pro\AtomTime.EXE"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AtomTime

vptray C:\Program Files\NavNT\vptray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\vptray

UpdReg C:\WINNT\Updreg.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\UpdReg

TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TkBellExe

Logitech Utility Logi_MwX.Exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Logitech Utility

IDesktop.2.5 C:\PROGRA~1\IMMERS~1\TOUCHS~1\Clients\Desktop\IDesktop.exe 1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IDesktop.2.5

SunJavaUpdateSched C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched

iTunesHelper F:\Program Files\iTunes\iTunesHelper.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\iTunesHelper

UpdateManager "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\UpdateManager

IMONTRAY C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IMONTRAY

VideoBlaster F:\Program Files\Creative\VideoBlaster Digital VCR\BTWAKEUP.EXE
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\VideoBlaster

LTM2 C:\WINNT\winsrv\svchost.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\LTM2

TaskTray "C:\Program Files\Creative\TaskBar\CTLTray.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\TaskTray

TaskBar "C:\Program Files\Creative\TaskBar\CTLTask.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\TaskBar

Mozilla Quick Launch "F:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Mozilla Quick Launch

SpySweeper F:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SpySweeper

Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} not set C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D}

{5CA3D70E-1895-11CF-8E15-001234567890} C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll C:\WINNT\system32\dla\tfswshx.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}

****************************************
Toolbars:

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINNT\system32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINNT\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINNT\system32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINNT\system32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}

****************************************
All processes:

[System Process]
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
LSASS.EXE
svchost.exe
spoolsv.exe
msdtc.exe
cisvc.exe
CTSVCCDA.EXE
defwatch.exe
svchost.exe
gearsec.exe
AppServices.exe
rtvscan.exe
nvsvc32.exe
regsvc.exe
mstask.exe
tcpsvcs.exe
stisvc.exe
ULCDRSvr.exe
bt1.exe
WinMgmt.exe
MsPMSPSv.exe
svchost.exe
ADService.exe
inetinfo.exe
imonNT.exe
mqsvc.exe
MSGSYS.EXE
cidaemon.exe
cidaemon.exe
explorer.exe
mobsync.exe
promon.exe
CTHELPER.EXE
ADUserMon.exe
Imgicon.exe
printray.exe
qttask.exe
tfswctrl.exe
AtomTime.EXE
vptray.exe
EM_EXEC.EXE
IDesktop.exe
jusched.exe
iTunesHelper.ex
iPodService.exe
imontray.exe
TouchSense.exe
CTLTray.exe
CTLTask.exe
SpySweeper.exe
iM_Tray.exe
WinCinemaMgr.ex
ScannerFinder.e
desktopweather_
HOTSYNC.EXE
explorer.exe
Netscp.exe
svchost.exe
realsched.exe
spywarescanner.

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Default_Page_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page C:\WINNT\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

provider
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Local Page C:\WINNT\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

****************************************