Bazooka Adware and Spyware Scanner Log 177

****************************************
Bazooka Adware and Spyware Scanner v1.13.01
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 10:27:04.
OS: Windows NT 5.1
Database version: 1.930000
Database format version: 1.020000
Database date: 20040326
Current date: 2004-03-27 10:27


****************************************
Result when scanning:

No potentially unwanted software found.
****************************************
Auto start entries:
C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\desktop.ini
C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\desktop.ini
C:\Documents and Settings\MDG Customer\Start
Menu\Programs\Jeux\players\desktop.ini
C:\Documents and Settings\MDG Customer\Start
Menu\Programs\Jeux\players\desktop.ini

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
CTStartup C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CTStartup

QH Live Update Scheduler C:\PROGRA~1\Quick Heal\UPSCHD.EXE /Check
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QH Live
Update Scheduler

QH Office 2K Check C:\PROGRA~1\Quick Heal\O2KCHECK.EXE /CHECK
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QH
Office 2K Check

Quick Heal Startup Scan C:\PROGRA~1\Quick Heal\QHSTRT32.EXE /CHECK
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Quick
Heal Startup Scan

Quick Heal On-Line Protection C:\PROGRA~1\Quick Heal\CATEYE.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Quick
Heal On-Line Protection

Lexmark X74-X75 "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Lexmark
X74-X75

Openwares LiveUpdate C:\Program Files\LiveUpdate\LiveUpdate.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Openwares
LiveUpdate

ATIPTA C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ATIPTA

Quick Heal Messenger C:\PROGRA~1\Quick Heal\qhm32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Quick
Heal Messenger

Quick Heal Scheduler C:\PROGRA~1\Quick Heal\QHSCHED.EXE /startup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Quick
Heal Scheduler


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:


****************************************
Toolbars:

{8E718888-423F-11D2-876E-00A0C9082467} C:\WINDOWS\System32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{594CCCB9-A984-4D08-8C11-ED9365A3E728} Error when opening a registry key,
the key doesn't exist. Key:
HKEY_CLASSES_ROOT\CLSID\{594CCCB9-A984-4D08-8C11-ED9365A3E728}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\WebBrowser\{594CCCB9-A984-4D08-8C11-ED9365A3E728}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINDOWS\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{30D02401-6A81-11D0-8274-00C04FD5AE38} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38}

{32683183-48a0-441b-a342-7c2a440a9478} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{32683183-48a0-441b-a342-7c2a440a9478}

{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}

{EDC4193F-34AD-4D07-AA87-E3FDB89E3E76} Error when opening a registry key,
the key doesn't exist. Key:
HKEY_CLASSES_ROOT\CLSID\{EDC4193F-34AD-4D07-AA87-E3FDB89E3E76}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{EDC4193F-34AD-4D07-AA87-E3FDB89E3E76}

{EFA24E61-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}

{EFA24E62-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}

{EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer
Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}


****************************************
All processes:

[System Process]
System
smss.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
ati2evxx.exe
svchost.exe
svchost.exe
svchost.exe
LEXBCES.EXE
spoolsv.exe
LEXPPS.EXE
alg.exe
CTSVCCDA.EXE
ati2evxx.exe
Runservice.exe
explorer.exe
qhinstlr.exe
qhonsvc.exe
svchost.exe
wanmpsvc.exe
MsPMSPSv.exe
upschd.exe
lxbbbmgr.exe
lxbbbmon.exe
atiptaxx.exe
qhm32.exe
qhsched.exe
qhonline.exe
iexplore.exe
AcroRd32.exe
spywarescanner.exe

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Main\Default_Page_URL

Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Main\Default_Search_URL

Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

Default_Search_URL http://minisearch.startnow.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Search\Default_Search_URL

SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Search\SearchAssistant

CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Search\CustomizeSearch

http://

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

provider
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\SearchUrl\provider

Search Bar http://minisearch.startnow.com
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

Use Search Asst no
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search
Asst

SearchAssistant http://minisearch.startnow.com
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Search\SearchAssistant

CustomizeSearch http://minisearch.startnow.com
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Search\CustomizeSearch

User Stylesheet
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Styles\User
Stylesheet


****************************************