C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\MKS\Bin\NetMonSv.exe
C:\Program Files\MKS\Bin\mksmonsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware–authd.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MKS\Bin\mks_scan.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MKS\Bin\mks_menu.exe
C:\WINDOWS\system32\rundll32.exe
D:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Gadu–Gadu\gg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Ax\Pulpit\USDownloader13b4\USDownloader.exe
C:\Documents and Settings\Ax\Pulpit\HijackThis.exe

O4 – HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup –s
O4 – HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O10 – Hijacked Internet access by New.Net
O23 – Service: VMware DHCP Service (VMnetDHCP) – VMware, Inc. – C:\WINDOWS\system32\vmnetdhcp.exe