Bazooka Adware and Spyware Scanner Log 471

****************************************
Bazooka Adware and Spyware Scanner v1.13.01
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
Log created 12:30:45.
OS: Windows NT 5.1
Database version: 2.050000
Database format version: 1.020000
Database date: 20040526
Current date: 2004-06-04 12:30


****************************************
Result when scanning:

My Search Bar 777.777.778 %ProgramsDir%\MyWay\
D:\Program Files\MyWay\
http://www.kephyr.com/spywarescanner/library/mysearchbar/index.phtml

****************************************
Auto start entries:
D:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
C:\freeserve\freeserveconnectionkit\atdialler1.exe
D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
G:\Microsoft Office\Office10\OSA.EXE -b -l
D:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe -DeviceID 1066652977
D:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
C:\freeserve\freeserveconnectionkit\atdialler1.exe
D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
G:\Microsoft Office\Office10\OSA.EXE -b -l
D:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe -DeviceID 1066652977
D:\Documents and Settings\User\Start Menu\Programs\Startup\desktop.ini
G:\PowerQuest DataKeeper\DataKeeper.exe -c "D:\Documents and Settings\User\Local Settings\Application Data\DataKeeper\15.04.03 XPHome.dks"
D:\Documents and Settings\User\Start Menu\Programs\Startup\desktop.ini
G:\PowerQuest DataKeeper\DataKeeper.exe -c "D:\Documents and Settings\User\Local Settings\Application Data\DataKeeper\15.04.03 XPHome.dks"

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
MVRescue C:\MVRescue\mvrescue quit
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MVRescue

nwiz nwiz.exe /install
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\nwiz

WINDVDPatch CTHELPER.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WINDVDPatch

UpdReg D:\WINDOWS\UpdReg.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\UpdReg

InCD D:\Program Files\ahead\InCD\InCD.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\InCD

POINTER point32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\POINTER

NvCplDaemon RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon

NeroCheck D:\WINDOWS\system32\NeroCheck.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NeroCheck

Jet Detection D:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Jet Detection

IFSplash ImmSplsh.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IFSplash

Share-to-Web Namespace Daemon D:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Share-to-Web Namespace Daemon

PestPatrol Control Center D:\PROGRA~1\PESTPA~1\PPControl.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PestPatrol Control Center

PPMemCheck D:\PROGRA~1\PESTPA~1\PPMemCheck.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PPMemCheck

CookiePatrol D:\PROGRA~1\PESTPA~1\CookiePatrol.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CookiePatrol

AVG7_CC D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AVG7_CC

AVG7_EMC D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AVG7_EMC

pdfFactory Dispatcher v2 D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\pdfFactory Dispatcher v2

Zone Labs Client "D:\Program Files\Zone Labs\ZoneAlarmPro45\ZoneAlarm\zlclient.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Zone Labs Client

ctfmon.exe D:\WINDOWS\System32\ctfmon.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe

H/PC Connection Agent "G:\ActiveSync\WCESCOMM.EXE"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\H/PC Connection Agent


Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{53707962-6F74-2D53-2644-206D7942484F} not set G:\SPYBOT~1\SDHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}

{AA58ED58-01DD-4d91-8333-CF10577473F7} not set d:\windows\googletoolbar2.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}

{FFFFFEF0-5B30-21D4-945D-000000000000} G:\STARDO~1\SDIEInt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFEF0-5B30-21D4-945D-000000000000}


****************************************
Toolbars:

{8E718888-423F-11D2-876E-00A0C9082467} D:\WINDOWS\System32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}

{4E7D0B40-F575-4A29-9710-4675EAF4686A} D:\WINDOWS\System32\minijvAB.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4E7D0B40-F575-4A29-9710-4675EAF4686A}

{2318C2B1-4965-11d4-9B18-009027A5CD4F} d:\windows\googletoolbar2.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{2318C2B1-4965-11d4-9B18-009027A5CD4F}

{4E7D0B40-F575-4A29-9710-4675EAF4686A} D:\WINDOWS\System32\minijvAB.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{4E7D0B40-F575-4A29-9710-4675EAF4686A}

{2318C2B1-4965-11D4-9B18-009027A5CD4F} d:\windows\googletoolbar2.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} D:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} D:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{2318C2B1-4965-11D4-9B18-009027A5CD4F} d:\windows\googletoolbar2.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

{4E7D0B40-F575-4A29-9710-4675EAF4686A} D:\WINDOWS\System32\minijvAB.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4E7D0B40-F575-4A29-9710-4675EAF4686A}

{4D5C8C25-D075-11d0-B416-00C04FB90376} D:\WINDOWS\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{9455301C-CF6B-11D3-A266-00C04F689C50} D:\Program Files\Common Files\Microsoft Shared\Reference 2001\EROProj.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{9455301C-CF6B-11D3-A266-00C04F689C50}

{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} D:\WINDOWS\System32\Shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}

{32683183-48a0-441b-a342-7c2a440a9478} D:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}

{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} D:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}

{EFA24E62-B078-11D0-89E4-00C04FC9E26E} D:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}

{EFA24E64-B078-11D0-89E4-00C04FC9E26E} D:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}


****************************************
All processes:

[System Process]
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
LSASS.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SPOOLSV.EXE
EXPLORER.EXE
AVGAMSVR.EXE
AVGUPSVC.EXE
CooLSRV.exe
LiebertM.exe
MDM.EXE
NVSVC32.EXE
CTHELPER.EXE
InCD.exe
SVCHOST.EXE
POINT32.EXE
VSMON.EXE
HPGS2WND.EXE
PPControl.exe
PPMemCheck.exe
MsPMSPSv.exe
HPGS2WNF.EXE
CookiePatrol.exe
AVGCC.EXE
AVGEMC.EXE
FPPDIS2A.EXE
ZLCLIENT.EXE
CTFMON.EXE
WCESCOMM.EXE
atdialler1.exe
HPOOJD07.EXE
DataKeeper.exe
HPOEVM07.EXE
HPOIPM07.EXE
hpOSTS07.exe
hpOFXM07.exe
Ad-aware.exe
spywarescanner.exe
IEXPLORE.EXE

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Default_Page_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page D:\WINDOWS\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\

www http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www

http://home.microsoft.com/access/autosearch.asp?p=%s
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\

provider
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Local Page D:\WINDOWS\System32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Search Bar http://home.microsoft.com/search/lobby/search.asp
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar

Search Page http://home.microsoft.com/access/allinone.asp
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://news.bbc.co.uk/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

Use Search Asst yes
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst


****************************************