****************************************
Bazooka Spyware Scanner v1.13b2
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
support@kephyr.com
Log created 00:26:12.
OS: Windows NT 5.1
Database version: 1.670000
Database format version: 1.020000
Database date: 20040131
Current date: 2004-02-07 00:26
****************************************
Result when scanning:
Bargain Buddy 102.997.949 %ProgramsDir%\Bargain Buddy\
C:\Program Files\Bargain Buddy\
http://www.kephyr.com/spywarescanner/library/bargainbuddy/index.phtml
ClearSearch.bho1 729.977.000 {00000000-0000-0000-0000-000000000240}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-0000-0000-0000-000000000240}
http://www.kephyr.com/spywarescanner/library/clicktosearch/index.phtml
HelpExpress 738.900.001 %ProgramsDir%\Alset\
C:\Program Files\Alset\
http://www.kephyr.com/spywarescanner/library/helpexpress/index.phtml
IGetNet 692.118.540 %ProgramsDir%\ClearSearch\
C:\Program Files\ClearSearch\
http://www.kephyr.com/spywarescanner/library/igetnet/index.phtml
KeenValue.Updater 643.000.000 updater
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\updater
http://www.kephyr.com/spywarescanner/library/keenvalue.updater/index.phtml
KeenValue.Updater 643.000.001 %ProgramsDir%\Common Files\updater\
C:\Program Files\Common Files\updater\
http://www.kephyr.com/spywarescanner/library/keenvalue.updater/index.phtml
Look2Me 349.000.000
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DDFFA75A-E81D-4454-89FC-B9FD0631E726}\InprocServer32\ThreadingModel
http://www.kephyr.com/spywarescanner/library/look2me/index.phtml
My Search Bar 777.777.778 c:\Program Files\MyWay\
c:\Program Files\MyWay\
http://www.kephyr.com/spywarescanner/library/mysearchbar/index.phtml
n-CASE 102.165.199 %ProgramsDir%\n-Case\
C:\Program Files\n-Case\
http://www.kephyr.com/spywarescanner/library/ncase/index.phtml
P2P Networking 126.652.451 P2P Networking
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\P2P Networking
http://www.kephyr.com/spywarescanner/library/p2pnetworking/index.phtml
Points Manager 126.693.451 AltnetPointsManager
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AltnetPointsManager
http://www.kephyr.com/spywarescanner/library/peerpoints/index.phtml
Points Manager 123.321.334
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AltnetDM\DisplayName
http://www.kephyr.com/spywarescanner/library/peerpoints/index.phtml
PowerSearch 342.300.000 {4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D}
http://www.kephyr.com/spywarescanner/library/powersearch/index.phtml
SuperBar 090.090.002 c:\SuperBar Files\
c:\SuperBar Files\
http://www.kephyr.com/spywarescanner/library/superbar/index.phtml
SeekSeek 394.200.000 Mwsvm
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Mwsvm
http://www.kephyr.com/spywarescanner/library/seekseek/index.phtml
****************************************
Auto start entries:
C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\desktop.ini
C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l
C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\desktop.ini
C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l
C:\Documents and Settings\Joke Leunk\Menu Start\Programma's\Opstarten\desktop.ini
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\Joke Leunk\Menu Start\Programma's\Opstarten\desktop.ini
C:\Program Files\Outlook Express\msimn.exe
Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php
****************************************
Run entries:
NvCplDaemon RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon
nwiz nwiz.exe /install
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\nwiz
APVXDWIN "C:\Program Files\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\APVXDWIN
NeroCheck C:\WINDOWS\system32\NeroCheck.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NeroCheck
Lexmark X74-X75 "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Lexmark X74-X75
AltnetPointsManager c:\program files\altnet\points manager\points manager.exe -s
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AltnetPointsManager
P2P Networking C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\P2P Networking
KAZAA "D:\Kazaa\Kazaa Lite K++\kpp.exe" "D:\Kazaa\Kazaa Lite K++\KazaaLite.kpp" /SYSTRAY
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\KAZAA
updater C:\Program Files\Common files\updater\wupdater.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\updater
Mwsvm C:\WINDOWS\mwsvm.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Mwsvm
Microsoft Works Update Detection C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Works Update Detection
QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task
frsk C:\WINDOWS\frsk.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\frsk
NvMediaCenter RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\NvMediaCenter
Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php
****************************************
Browser helper objects:
{00000000-0000-0000-0000-000000000240} Clear Search C:\Program Files\ClearSearch\IE_ClrSch.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-0000-0000-0000-000000000240}
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set c:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
{1bd9f673-7c26-4a68-a963-6efcb7d0385d} not set C:\DOCUME~1\BERTIN~1\APPLIC~1\woashlcktrgr.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1bd9f673-7c26-4a68-a963-6efcb7d0385d}
{7173FB17-53E7-49CD-BB1A-DE3D59487D1C} not set C:\WINDOWS\System32\uqosname.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7173FB17-53E7-49CD-BB1A-DE3D59487D1C}
****************************************
Toolbars:
{8E718888-423F-11D2-876E-00A0C9082467} C:\WINDOWS\System32\msdxm.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8E718888-423F-11D2-876E-00A0C9082467}
{7AA616C1-CCFB-4B1E-9FB3-3F40FCD6D696} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{7AA616C1-CCFB-4B1E-9FB3-3F40FCD6D696}\InprocServer32
System error message: Het systeem kan het opgegeven bestand niet vinden.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AA616C1-CCFB-4B1E-9FB3-3F40FCD6D696}
{4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D} C:\PROGRA~1\POWERS~1\Toolbar\pwrswmda.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D}
{c8517d4b-9b28-428c-a88c-596bdad83cd4} C:\DOCUME~1\BERTIN~1\APPLIC~1\woashlcktrgr.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{c8517d4b-9b28-428c-a88c-596bdad83cd4}
{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}
{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
{C8517D4B-9B28-428C-A88C-596BDAD83CD4} C:\DOCUME~1\BERTIN~1\APPLIC~1\woashlcktrgr.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{C8517D4B-9B28-428C-A88C-596BDAD83CD4}
{7AA616C1-CCFB-4B1E-9FB3-3F40FCD6D696} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{7AA616C1-CCFB-4B1E-9FB3-3F40FCD6D696}\InprocServer32
System error message: Het systeem kan het opgegeven bestand niet vinden.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AA616C1-CCFB-4B1E-9FB3-3F40FCD6D696}
{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINDOWS\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
{32683183-48a0-441b-a342-7c2a440a9478} C:\WINDOWS\System32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
{EFA24E64-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\System32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
****************************************
All processes:
[System Process]
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
LSASS.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
LEXBCES.EXE
SPOOLSV.EXE
LEXPPS.EXE
MDM.EXE
NVSVC32.EXE
Pavsrv51.exe
SVCHOST.EXE
Avengine.exe
EXPLORER.EXE
Apvxdwin.exe
LXBBBMGR.EXE
Points Manager.exe
WUPDATER.EXE
WkUFind.exe
QTTASK.EXE
LXBBBMON.EXE
KazaaLite.kpp
mwsoemon.exe
RUNDLL32.EXE
asm.exe
msoffice.exe
Pavproxy.exe
IEXPLORE.EXE
ctfmon.exe
IEXPLORE.EXE
msimn.exe
MSMSGS.EXE
spywarescanner.exe
WINWORD.EXE
AgentSvr.exe
Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php
****************************************
Internet Explorer Settings:
Default_Page_URL
http://www.startpagina.nl
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
Local Page C:\WINDOWS\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
Search Bar
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar
Search Page
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
Start Page
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
CustomizeSearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\
www
http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\www
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\
provider
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider
Local Page C:\WINDOWS\System32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
Search Bar
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
Start Page
http://www.startpagina.nl/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
Use Search Asst no
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst
****************************************