ComboFix
ComboFix 08-01-16.4 - Adrian 2008-01-16 15:57:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.639 [GMT 1:00]
Running from: C:\Documents and Settings\Adrian.BAGNET\Pulpit\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\check_LSA7.txt
C:\WINDOWS\system32\awvtq.dll
C:\WINDOWS\system32\fbaffedaacc_g.dll
C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\jkhfe.dll
C:\WINDOWS\system32\jkhhf.dll
C:\WINDOWS\system32\jkhhh.dll
C:\WINDOWS\system32\mllji.dll
C:\WINDOWS\system32\pmkhi.dll
C:\WINDOWS\system32\pmnll.dll
C:\WINDOWS\system32\ssqrr.dll
C:\WINDOWS\system32\vtstq.dll
C:\WINDOWS\system32\vturq.dll
D:\autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_NPF
((((((((((((((((((((((((( Files Created from 2007-12-16 to 2008-01-16 )))))))))))))))))))))))))))))))
.
2008-01-16 15:56 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-15 17:41 . 2008-01-15 17:41 <DIR> d-------- C:\Documents and Settings\Adrian.BAGNET\.thumbnails
2008-01-15 09:36 . 2008-01-15 12:52 <DIR> d-------- C:\Program Files\TelForceOne Web Katalog
2008-01-12 20:04 . 2008-01-15 17:41 <DIR> d-------- C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\gtk-2.0
2008-01-12 19:59 . 2008-01-15 17:43 <DIR> d-------- C:\Documents and Settings\Adrian.BAGNET\.gimp-2.4
2008-01-12 19:58 . 2008-01-12 19:58 <DIR> d-------- C:\Program Files\GIMP-2.0
2008-01-11 15:40 . 2008-01-11 15:40 <DIR> dr------- C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\SpaceTime 3D
2008-01-05 14:30 . 2008-01-05 14:30 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-01-04 21:27 . 2008-01-16 15:59 <DIR> d-------- C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\BitTorrent DNA
2008-01-04 21:08 . 2008-01-15 17:56 <DIR> d-------- C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\Azureus
2008-01-04 20:39 . 2008-01-07 18:41 <DIR> d-------- C:\Program Files\uTorrent
2008-01-04 20:39 . 2008-01-16 09:18 <DIR> d-------- C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\uTorrent
2008-01-04 15:36 . 2008-01-04 15:36 <DIR> d-------- C:\Program Files\BurnAware Free Edition
2008-01-04 15:36 . 2008-01-04 15:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\{299A4764-43F6-4187-8CA5-672EB6C4D431}
2008-01-01 13:57 . 2008-01-08 19:34 <DIR> dr------- C:\Program Files\Aston
2008-01-01 13:57 . 2008-01-01 13:57 <DIR> d-------- C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\Aston
2008-01-01 13:53 . 2008-01-01 13:53 <DIR> d-------- C:\LeoShell
2007-12-29 11:49 . 2007-12-29 11:49 <DIR> d-------- C:\Program Files\A4K12 JoyPad Driver
2007-12-28 21:53 . 2007-12-29 10:53 486 --a------ C:\WINDOWS\eReg.dat
2007-12-28 18:36 . 2007-12-28 18:36 <DIR> d-------- C:\Program Files\Sanmos Microelectronics
2007-12-28 17:32 . 2007-12-28 17:32 <DIR> d-------- C:\Program Files\Twin Shock GamePad
2007-12-24 21:32 . 2007-12-24 21:32 <DIR> d-------- C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\InstallShield
2007-12-21 15:15 . 2007-12-21 15:15 <DIR> d-------- C:\Program Files\AnyReader
2007-12-21 15:11 . 2007-12-21 15:11 <DIR> d-------- C:\Program Files\Jufsoft
2007-12-21 14:40 . 2007-12-21 14:40 <DIR> d-------- C:\Program Files\directx
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-16 14:55 --------- d-----w C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\MegauploadToolbar
2008-01-16 09:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-01-15 17:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-15 08:11 --------- d-----w C:\Program Files\MegauploadToolbar
2008-01-13 19:42 --------- d-----w C:\Documents and Settings\Rodzice\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-01-04 20:27 --------- d-----w C:\Program Files\BitTorrent_DNA
2007-12-21 14:18 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-15 09:13 --------- d-----w C:\Program Files\AutoConnect
2007-12-13 09:09 --------- d-----w C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\Tibia
2007-12-11 16:14 --------- d-----w C:\Program Files\Mioplanet
2007-12-11 16:13 407,559 ----a-w C:\WINDOWS\system32\mioengine.exe
2007-12-09 11:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2007-12-03 19:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\G DATA
2007-12-03 19:17 28,066 ----a-w C:\WINDOWS\system32\drivers\HookCentre.sys
2007-12-03 19:17 --------- d-----w C:\Program Files\Common Files\G DATA
2007-12-03 19:17 --------- d-----w C:\Program Files\CDRecordKit
2007-12-03 19:13 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-03 16:43 --------- d-----w C:\Program Files\Java
2007-12-03 16:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2007-12-02 12:00 --------- d-----w C:\Program Files\MSXML 6.0
2007-12-02 10:45 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\ArcaBit
2007-12-01 16:56 --------- d-----w C:\Documents and Settings\Rodzice\Dane aplikacji\Winamp
2007-11-29 12:57 --------- d-----w C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\Winamp
2007-11-29 12:46 --------- d-----w C:\Program Files\Winamp Toolbar
2007-11-29 12:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-11-26 13:05 98,304 ----a-w C:\WINDOWS\system32\qttask.exe
2007-11-26 13:03 --------- d-----w C:\Program Files\ACE Mega CoDecS Pack
2007-11-24 10:06 --------- d-----w C:\Documents and Settings\Adrian.BAGNET\Dane aplikacji\ViStart
2007-11-23 19:11 --------- d-----w C:\Program Files\Common Files\Adobe
2007-11-17 11:39 --------- d-----w C:\Program Files\Realtek
2007-11-17 10:56 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-11-17 10:46 --------- d-----w C:\Program Files\WIDCOMM
2007-11-17 10:42 --------- d-----w C:\Program Files\SendFile
2007-11-17 10:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\SmartCom
2007-11-14 15:59 410,984 ----a-w C:\WINDOWS\system32\pr2agqwb.exe
2007-11-13 16:25 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2007-11-13 16:25 249,856 ------w C:\WINDOWS\Setup1.exe
2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-06 11:27 155,648 ----a-w C:\WINDOWS\system32\SSCE5232.dll
2007-11-06 11:26 82,432 ----a-w C:\WINDOWS\system32\msxml4r.dll
2007-11-06 11:26 44,544 ----a-w C:\WINDOWS\system32\msxml4a.dll
2007-11-06 11:24 397,856 ----a-w C:\WINDOWS\system32\XceedZIP.dll
2007-11-06 11:24 107,530 ----a-w C:\WINDOWS\system32\xcdsfx32.bin
2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D2F8F919-690B-4EA2-9FA7-A203D1E04F75}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{3F3714A9-89A4-46BE-8AF3-D0C9D1FB03F9}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
{0124123D-61B4-456F-AF86-78C53A0790C5}
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}
[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]
[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00 15360]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [ ]
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe" [2007-09-25 13:53 286016]
"Konnekt"="e:\Program Files\Konnekt\konnekt.exe" [2005-05-24 22:41 503808]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 09:56 16261632 C:\WINDOWS\RTHDCPL.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnlll]
ssqnlll.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqropo]
urqropo.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^G DATA Firewall Tray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\G DATA Firewall Tray.lnk
backup=C:\WINDOWS\pss\G DATA Firewall Tray.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ViOrb.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ViOrb.lnk
backup=C:\WINDOWS\pss\ViOrb.lnkCommon Startup
R0 GDNdisIc;GDNdisIc;C:\WINDOWS\system32\drivers\GDNdisIc.sys [2007-09-08 13:35]
R0 pe3agqwb;Loki Environment Driver (pe3agqwb);C:\WINDOWS\system32\drivers\pe3agqwb.sys [2007-11-14 16:59]
R0 pe3agqwc;Loki Environment Driver (pe3agqwc);C:\WINDOWS\system32\drivers\pe3agqwc.sys [2007-08-02 18:48]
R0 ps6agqwc;Loki Synchronization Driver (ps6agqwc);C:\WINDOWS\system32\drivers\ps6agqwc.sys [2007-08-02 18:48]
R0 ps7agqwb;Loki Synchronization Driver (ps7agqwb);C:\WINDOWS\system32\drivers\ps7agqwb.sys [2007-11-14 16:58]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-10-13 14:46]
R0 WPXT;WinPcap Packet Driver (WPXT);C:\WINDOWS\system32\drivers\WPXT.sys [2007-05-21 08:02]
R1 GLogin;GLogin;C:\WINDOWS\system32\drivers\GLogin.sys [2007-05-07 07:47]
R2 AVKProxy;AVKProxy;"C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe" [2006-04-24 14:17]
R2 AVKService;AVK Service;"e:\Program files\G DATA\AntiVirenKit InternetSecurity 2006\AVK\AVKService.exe" [2004-09-28 09:59]
R2 AVKWCtl;Strażnik AVK;"e:\Program files\G DATA\AntiVirenKit InternetSecurity 2006\AVK\AVKWCtl.exe" [2005-08-15 16:09]
R2 GDTdiInterceptor;GDTdiInterceptor;C:\WINDOWS\system32\drivers\GDTdiIcpt.sys [2007-09-08 13:35]
R3 GDFwSvc;G DATA Personal Firewall;e:\Program files\G DATA\AntiVirenKit InternetSecurity 2006\Firewall\GDFwSvc.exe [2006-05-08 13:34]
R3 GDInterceptor;GDInterceptor;C:\WINDOWS\system32\interceptor.sys [2007-09-08 13:36]
R3 HookCentre;HookCentre;C:\WINDOWS\system32\drivers\HookCentre.sys [2007-12-03 20:17]
S2 KbdLockService;G DATA Keyboard Protector Service;"C:\WINDOWS\system32\KbdLockService.exe" []
S2 pr2agqwb;Loki Drivers Auto Removal (pr2agqwb);C:\WINDOWS\system32\pr2agqwb.exe svc []
S2 pr2agqwc;Loki Drivers Auto Removal (pr2agqwc);C:\WINDOWS\system32\pr2agqwc.exe svc []
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-10-24 14:09]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 16:01:41
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-16 16:03:39 - machine was rebooted [Adrian]
ComboFix-quarantined-files.txt 2008-01-16 15:03:36
.
2008-01-09 11:09:35 --- E O F ---
hijackThis
Logfile of HijackThis v1.99.1
Scan saved at 16:06:05, on 2008-01-16
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
e:\Program files\G DATA\AntiVirenKit InternetSecurity 2006\AVK\AVKService.exe
e:\Program files\G DATA\AntiVirenKit InternetSecurity 2006\AVK\AVKWCtl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
e:\Program files\G DATA\AntiVirenKit InternetSecurity 2006\Firewall\GDFwSvc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BitTorrent_DNA\dna.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\ADRIAN~1.BAG\USTAWI~1\Temp\ARC68\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\1.bin\MBSRCAS.DLL (file missing)
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - e:\Program Files\G DATA\AntiVirenKit InternetSecurity 2006\Webfilter\AvkWebIE.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {D73F49B1-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\1.bin\MBSRCAS.DLL (file missing)
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - e:\Program Files\G DATA\AntiVirenKit InternetSecurity 2006\Webfilter\AvkWebIE.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe"
O4 - HKCU\..\Run: [Konnekt] "e:\Program Files\Konnekt\konnekt.exe" /autostart
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: ssqnlll - ssqnlll.dll (file missing)
O20 - Winlogon Notify: urqropo - urqropo.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - e:\Program Files\Ares\chatServer.exe
O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: AVK Service (AVKService) - Unknown owner - e:\Program files\G DATA\AntiVirenKit InternetSecurity 2006\AVK\AVKService.exe
O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - e:\Program files\G DATA\AntiVirenKit InternetSecurity 2006\AVK\AVKWCtl.exe
O23 - Service: G DATA Personal Firewall (GDFwSvc) - Unknown owner - e:\Program files\G DATA\AntiVirenKit InternetSecurity 2006\Firewall\GDFwSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: G DATA Keyboard Protector Service (KbdLockService) - Unknown owner - C:\WINDOWS\system32\KbdLockService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Loki Drivers Auto Removal (pr2agqwb) (pr2agqwb) - Cyanide - C:\WINDOWS\system32\pr2agqwb.exe
O23 - Service: Loki Drivers Auto Removal (pr2agqwc) (pr2agqwc) - Cyanide - C:\WINDOWS\system32\pr2agqwc.exe
