[code]ComboFix 08-03-08.2 - Administrator 2008-03-09 11:23:31.2 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.945 [GMT 1:00] Running from: C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Pulpit\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users.WINDOWS\Menu Start\Live Safety Center.lnk C:\Documents and Settings\All Users.WINDOWS\Menu Start\Online Security Guide.lnk C:\Documents and Settings\pina\Ulubione\Online Security Guide.lnk C:\WINDOWS\system32\rwpqjiwy.dllbox . ((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 ))))))))))))))))))))))))))))))) . 2008-03-08 22:44 . 2008-03-08 22:44 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Dane aplikacji\Spik 2008-03-08 22:17 . 2008-03-08 22:17 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Dane aplikacji\Media Player Classic 2008-03-08 22:12 . 2008-03-08 22:15 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Dane aplikacji\foobar2000 2008-03-08 22:09 . 2008-03-08 22:09 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Dane aplikacji\Gadu-Gadu 2008-03-08 22:00 . 2008-03-08 22:00 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Gadu-Gadu 2008-03-08 19:19 . 2008-03-08 19:51 d--h----- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Ustawienia lokalne 2008-03-08 19:19 . 2007-05-18 16:44 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Ulubione 2008-03-08 19:19 . 2007-05-18 14:58 d--h----- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Szablony 2008-03-08 19:19 . 2008-03-09 11:22 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Pulpit 2008-03-08 19:19 . 2007-05-18 16:44 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Moje dokumenty 2008-03-08 19:19 . 2007-05-18 16:44 dr------- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Menu Start 2008-03-08 19:19 . 2007-05-18 16:44 dr-h----- C:\Documents and Settings\Administrator.UNDER-9397BA12E.000\Dane aplikacji 2008-03-08 18:28 . 2007-05-18 16:44 d--h----- C:\Documents and Settings\Administrator.UNDER-9397BA12E\Ustawienia lokalne 2008-03-08 18:28 . 2007-05-18 16:44 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E\Ulubione 2008-03-08 18:28 . 2007-05-18 14:58 d--h----- C:\Documents and Settings\Administrator.UNDER-9397BA12E\Szablony 2008-03-08 18:28 . 2007-05-18 16:44 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E\Pulpit 2008-03-08 18:28 . 2007-05-18 16:44 d-------- C:\Documents and Settings\Administrator.UNDER-9397BA12E\Moje dokumenty 2008-03-08 18:28 . 2007-05-18 16:44 dr------- C:\Documents and Settings\Administrator.UNDER-9397BA12E\Menu Start 2008-03-08 18:28 . 2007-05-18 16:44 dr-h----- C:\Documents and Settings\Administrator.UNDER-9397BA12E\Dane aplikacji 2008-02-16 22:27 . 2008-03-07 16:19 d-------- C:\Documents and Settings\pina\Dane aplikacji\mIRC 2008-02-14 09:35 . 2003-05-26 19:19 532,544 --a------ C:\WINDOWS\PIC.dll 2008-02-14 09:35 . 2003-07-29 18:06 515,584 --a------ C:\WINDOWS\zHotkey.exe 2008-02-14 09:35 . 2003-09-19 09:09 36,864 --a------ C:\WINDOWS\ShowWnd.exe 2008-02-14 09:35 . 2001-07-02 20:36 24,576 --a------ C:\WINDOWS\HKNTDLL.dll 2008-02-14 09:35 . 2000-08-07 11:57 5,280 --a------ C:\WINDOWS\hotbtnv.vxd 2008-02-14 09:35 . 2004-03-02 09:40 3,926 --a------ C:\WINDOWS\mHotkey.reg 2008-02-13 20:28 . 2008-02-13 20:29 d--h----- C:\WINDOWS\system32\GroupPolicy 2008-02-13 16:57 . 2008-02-13 16:58 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-02-13 16:53 . 2008-02-13 16:53 d-------- C:\Program Files\A4Tech 2008-02-11 18:59 . 2008-02-11 19:02 d-------- C:\Program Files\AOL Companion 2008-02-11 18:57 . 2008-02-11 18:59 d-------- C:\Program Files\Common Files\aolshare 2008-02-11 18:57 . 2008-02-19 12:39 d-------- C:\Program Files\America Online 9.0 2008-02-11 18:57 . 2003-08-15 15:17 153,088 --a------ C:\WINDOWS\system32\jgdwmie.dll 2008-02-11 18:57 . 2003-01-10 17:13 65,536 --a------ C:\WINDOWS\wanmpsvc.exe 2008-02-11 18:57 . 2003-01-10 17:13 33,588 --a------ C:\WINDOWS\system32\drivers\wanatw4.sys 2008-02-11 18:57 . 2003-08-15 15:16 24,659 --a------ C:\WINDOWS\system32\aolddial.dll 2008-02-11 15:38 . 2008-02-11 18:32 6 --a------ C:\WINDOWS\msoffice.ini 2008-02-10 10:55 . 2008-02-11 15:38 d-------- C:\Documents and Settings\pina\Dane aplikacji\AOL . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-08 14:00 --------- d-----w C:\Documents and Settings\pina\Dane aplikacji\foobar2000 2008-03-06 18:53 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-02-22 14:19 --------- d-----w C:\Program Files\Common Files\AOL 2008-02-14 08:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-13 20:20 --------- d-----w C:\Documents and Settings\pina\Dane aplikacji\Thinstall 2008-02-13 15:58 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Microsoft Help 2008-02-11 17:58 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\AOL 2008-02-10 09:49 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\AOL Downloads 2008-02-07 15:24 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\FLEXnet 2008-02-07 14:40 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-07 14:40 --------- d-----w C:\Program Files\Bonjour 2008-02-07 14:23 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2008-02-06 14:44 --------- d-----w C:\Program Files\Java 2008-02-02 12:56 --------- d-----w C:\Documents and Settings\pina\Dane aplikacji\gtk-2.0 2008-02-01 22:05 --------- d-----w C:\Program Files\Techland 2008-01-30 18:19 10,920 ----a-w C:\aolconnfix.exe 2008-01-30 18:15 --------- d-----w C:\Program Files\Learn2.com 2008-01-30 18:15 --------- d-----w C:\Program Files\Common Files\Nullsoft 2008-01-19 18:28 --------- d-----w C:\Documents and Settings\pina\Dane aplikacji\Hamachi 2008-01-14 20:48 --------- d-----w C:\Program Files\RSSoft 2008-01-14 18:05 --------- d-----w C:\Documents and Settings\pina\Dane aplikacji\Winamp 2008-01-14 12:09 --------- d-----w C:\Program Files\AdVantage 2007-05-18 15:29 5,936 ----a-w C:\Program Files\Colorific.ini 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2002-02-11 11:35 1,913 ----a-w C:\Program Files\PRESET.INF 2002-02-11 09:35 172 ----a-w C:\Program Files\colorific.inf . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B8A7839C-51E8-4067-ADA3-CA74BABC1976}] 2007-06-15 23:48 341696 --------- F:\Program Files\GigaSize.com Inc\GigaSize Toolbar\Kenciatb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{B8A7839C-51E8-4067-ADA3-CA74BABC1976}"= "F:\Program Files\GigaSize.com Inc\GigaSize Toolbar\Kenciatb.dll" [2007-06-15 23:48 341696] [HKEY_CLASSES_ROOT\clsid\{b8a7839c-51e8-4067-ada3-ca74babc1976}] [HKEY_CLASSES_ROOT\Kenciatb.Band.1] [HKEY_CLASSES_ROOT\TypeLib\{00D202E3-2516-4187-A930-DA295B2E42F6}] [HKEY_CLASSES_ROOT\Kenciatb.Band] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360] "Gadu-Gadu"="F:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36 2111176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 11:08 172032] "DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2002-12-02 19:56 40960] "V0220Mon.exe"="C:\WINDOWS\V0220Mon.exe" [2006-06-28 18:01 32768] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47 31016] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-10-12 21:00 294912] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-01 11:29 52840] "SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2005-10-03 10:09 218712] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22 517768] "WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2005-09-21 19:23 159744] "ShowWnd"="ShowWnd.exe" [2003-09-19 09:09 36864 C:\WINDOWS\ShowWnd.exe] "HostManager"="C:\Program Files\Common Files\AOL\1203689944\ee\AOLSoftware.exe" [2006-09-26 01:52 50736] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-03 23:44 159744] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360] C:\Documents and Settings\pina\Menu Start\Programy\AutostartTworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 19:24:54 98632] [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Privoxy.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Privoxy.lnk backup=C:\WINDOWS\pss\Privoxy.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage] --a------ 2007-06-28 15:19 880080 C:\Program Files\AdVantage\AdVantage.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVFX Engine] --------- 2006-06-09 00:11 24576 C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey] --a------ 2003-07-29 18:06 515584 C:\WINDOWS\zHotkey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Live! Cam Manager] --------- 2006-05-31 15:00 143360 C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] -ra------ 2002-12-17 10:40 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-06-01 15:51 257088 F:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 17:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-04-27 08:41 282624 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Red Swoosh] --a------ 2007-07-19 03:17 62436 C:\Program Files\RSSoft\RedSwoosh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 19:24 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 06:28 36352 G:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\America Online 9.0\\waol.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9420:TCP"= 9420:TCP:Red Swoosh "5000:UDP"= 5000:UDP:Red Swoosh "26857:TCP"= 26857:TCP:BitComet 26857 TCP "26857:UDP"= 26857:UDP:BitComet 26857 UDP R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2005-09-21 16:27] S2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-08-03 16:40] S3 V0220Dev;Live! Cam Video IM;C:\WINDOWS\system32\DRIVERS\V0220Dev.sys [2006-06-29 06:58] S3 V0220Vfx;V0220VFX;C:\WINDOWS\system32\DRIVERS\V0220Vfx.sys [2006-06-08 09:00] . Contents of the 'Scheduled Tasks' folder "2008-03-07 19:01:07 C:\WINDOWS\Tasks\Norton AntiVirus - Uruchom pełne skanowanie systemu - pina.job" - G:\PROGRA~1\NORTON~1\Navw32.exen/TASK: "2007-09-22 09:30:54 C:\WINDOWS\Tasks\Norton AntiVirus - Uruchom szybkie skanowanie - pina.job" - G:\PROGRA~1\NORTON~1\NAVW32.EXEm/TASK: . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-09 11:25:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-09 11:26:27 ComboFix-quarantined-files.txt 2008-03-09 10:26:19 ComboFix2.txt 2007-10-19 15:03:46 . 2008-02-13 16:00:55 --- E O F --- Logfile of HijackThis v1.99.1 Scan saved at 11:17:39, on 2008-03-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE F:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Microsoft Office\Office12\WINWORD.EXE C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\pina\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - G:\Program Files\ivo\Expressivo\IH_iexplore.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - G:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: GigaSize toolbar - {B8A7839C-51E8-4067-ADA3-CA74BABC1976} - F:\Program Files\GigaSize.com Inc\GigaSize Toolbar\Kenciatb.dll O3 - Toolbar: GigaSize toolbar - {B8A7839C-51E8-4067-ADA3-CA74BABC1976} - F:\Program Files\GigaSize.com Inc\GigaSize Toolbar\Kenciatb.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - G:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - G:\Program Files\ivo\Expressivo\IH_iexplore.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1203689944\ee\AOLSoftware.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "F:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {0015690D-1D8A-45bc-81A7-B7C63E9CABCD} - F:\Program Files\GigaSize.com Inc\GigaSize Toolbar\Kenciatb.dll O9 - Extra 'Tools' menuitem: GigaSize toolbar - {0015690D-1D8A-45bc-81A7-B7C63E9CABCD} - F:\Program Files\GigaSize.com Inc\GigaSize Toolbar\Kenciatb.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll O9 - Extra button: (no name) - {18955D47-882E-48fc-B903-A4BDD030E7FD} - (no file) O9 - Extra 'Tools' menuitem: GigaSize Toolbar - {18955D47-882E-48fc-B903-A4BDD030E7FD} - (no file) O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O11 - Options group: [INTERNATIONAL] International* O17 - HKLM\System\CCS\Services\Tcpip\..\{0407C77E-51FF-42CC-BC68-8ADC49002F6B}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{0407C77E-51FF-42CC-BC68-8ADC49002F6B}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{0407C77E-51FF-42CC-BC68-8ADC49002F6B}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS3\Services\Tcpip\..\{0407C77E-51FF-42CC-BC68-8ADC49002F6B}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS4\Services\Tcpip\..\{0407C77E-51FF-42CC-BC68-8ADC49002F6B}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS5\Services\Tcpip\..\{0407C77E-51FF-42CC-BC68-8ADC49002F6B}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS6\Services\Tcpip\..\{0407C77E-51FF-42CC-BC68-8ADC49002F6B}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - F:\Program Files\Spik\url_wpmsg.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWSO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - F:\Program Files\a-squared Free\a2service.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: Usługa Auto-Protect programu Norton AntiVirus (navapsvc) - Symantec Corporation - G:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - G:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Usługa Norton Protection Center (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - G:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe [/code]