O2 – BHO: (no name) – {4E7BD74F–2B8D–469E–DCF7–F96DA086B434} – C:WINDOWSDOWNLO~1instafin.dll
O4 – HKLM..Run: [WebRebates0] "C:Program FilesWeb_RebatesWebRebates0.exe"
O8 – Extra context menu item: Web Rebates – file://C:Program FilesWeb_RebatesSy1150Tp1150scri1150a.htm

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32LEXBCES.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32LEXPPS.EXE
C:WINDOWSExplorer.EXE
C:WINDOWSSOUNDMAN.EXE
C:Program FilesJavaj2re1.4.2_03injusched.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSSystem32ctfmon.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
C:Program FilesNorton AntiVirus avapsvc.exe
C:WINDOWSSystem32 vsvc32.exe
C:Program FilesNorton AntiVirusSAVScan.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesGadu–Gadugg.exe
C:Program FilesMozilla Firefoxfirefox.exe
E:FlashGet 1.60 aFlashGetflashget.exe
C:Program FilesInternet Exploreriexplore.exe
C:Documents and SettingsuserDane aplikacjiaoic.exe
C:PROGRA~1EZULAmmod.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesWeb_RebatesWebRebates0.exe
C:Program FilesWeb_RebatesWebRebates1.exe
C:Program FilesCommon FilesSymantec SharedNMain.exe
E:PROGRAMYHijackThis.exe

R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://wp.pl/
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://wp.pl
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: (no name) – {20EC3D2D–33C1–4C9D–BC37–C2D500688DA2} – C:Program FilesTV MediaTvmBho.dll
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 – BHO: Idea2 SidebarBrowserMonitor Class – {45AD732C–2CE2–4666–B366–B2214AD57A49} – E:Wygląd XPSideBarsbhelp.dll
O2 – BHO: (no name) – {4E7BD74F–2B8D–469E–DCF7–F96DA086B434} – C:WINDOWSDOWNLO~1instafin.dll
O2 – BHO: (no name) – {A5366673–E8CA–11D3–9CD9–0090271D075B} – E:FLASHG~1.60AFLASHGETjccatch.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll
O3 – Toolbar: FlashGet Bar – {E0E899AB–F487–11D5–8D29–0050BA6940E3} – E:FLASHG~1.60AFLASHGETfgiebar.dll
O3 – Toolbar: &Google – {2318C2B1–4965–11d4–9B18–009027A5CD4F} – C:WINDOWSDownloaded Program Filesgooglenav.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton AntiVirusNavShExt.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O4 – HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_03injusched.exe
O4 – HKLM..Run: [Resume copy] copyfstq.exe /startup
O4 – HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
O4 – HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 – HKLM..Run: [NAV CfgWiz] C:Program FilesCommon FilesSymantec SharedCfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 – HKLM..Run: [TV Media] C:Program FilesTV MediaTvm.exe
O4 – HKLM..Run: [WebRebates0] "C:Program FilesWeb_RebatesWebRebates0.exe"
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [STYLEXP] C:Program FilesTGTSoftStyleXPStyleXP.exe –Hide
O4 – HKCU..Run: [WITaj!] rem –– Anulowane uruchamianie programu WITaj! 2000
O4 – HKCU..Run: [TV Media] C:Program FilesTV MediaTvm.exe
O4 – Startup: Power Project.lnk = E:GADU GADU 2Gadu–GaduPowerGG.exe
O4 – Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O8 – Extra context menu item: &Google Search – res://C:WINDOWSDownloaded Program Filesgooglenav.dll/cmsearch.html
O8 – Extra context menu item: Backward &Links – res://C:WINDOWSDownloaded Program Filesgooglenav.dll/cmbacklinks.html
O8 – Extra context menu item: Cac&hed Snapshot of Page – res://C:WINDOWSDownloaded Program Filesgooglenav.dll/cmcache.html
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O8 – Extra context menu item: Si&milar Pages – res://C:WINDOWSDownloaded Program Filesgooglenav.dll/cmsimilar.html
O8 – Extra context menu item: Subscribe in Desktop Sidebar – res://E:Wygląd XPSideBarsbhelp.dll/menuhandler.html
O8 – Extra context menu item: Web Rebates – file://C:Program FilesWeb_RebatesSy1150Tp1150scri1150a.htm
O8 – Extra context menu item: Ściągnij przy pomocy FlashGet'a – E:FlashGet 1.60 aFlashGetjc_link.htm
O8 – Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a – E:FlashGet 1.60 aFlashGetjc_all.htm
O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 – Extra button: Subscribe in Desktop Sidebar (HKLM)
O9 – Extra 'Tools' menuitem: Subscribe in Desktop Sidebar (HKLM)
O9 – Extra button: FlashGet (HKLM)
O9 – Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 – Extra button: Messenger (HKLM)
O9 – Extra 'Tools' menuitem: Messenger (HKLM)
O12 – Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O16 – DPF: {0000000A–0000–0010–8000–00AA00389B71} – http://download.microsoft.com/download/d/4/4/d446e8a9–3a86–4b59–bb19–f5bd11b40367/wmavax.CAB
O16 – DPF: {02BF25D5–8C17–4B23–BC80–D3488ABDDC6B} (QuickTime Object) – http://www.apple.com/qtactivex/qtplugin.cab
O16 – DPF: {166B1BCA–3F9C–11CF–8075–444553540000} (Shockwave ActiveX Control) – http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 – DPF: {33564D57–0000–0010–8000–00AA00389B71} – http://download.microsoft.com/download/F/6/E/F6E491A6–77E1–4E20–9F5F–94901338C922/wmv9VCM.CAB
O16 – DPF: {6CB5E471–C305–11D3–99A8–000086395495} (Google Activate) – http://toolbar.google.com/data/pl/big/1.1.62–big/GoogleNav.cab
O16 – DPF: {BFA1F11D–3121–AFE1–4112–894323212DAC} (GINWORDS Class) – http://gryonline.wp.pl/files/words_2_0_0_11.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab