- Kod: Zaznacz wszystko
ComboFix 08-10-23.01 - Jacek 2008-10-23 20:48:48.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.656 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\Jacek\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\boot.ini
C:\WINDOWS\g32.txt
C:\WINDOWS\system32\awtutsqQ.dll
C:\WINDOWS\system32\byXOhGVl.dll
C:\WINDOWS\system32\cbXNhHwT.dll
C:\WINDOWS\system32\ddcYonlj.dll
C:\WINDOWS\system32\ddcYqoNH.dll
C:\WINDOWS\system32\efcCsqrp.dll
C:\WINDOWS\system32\fccdefdC.dll
C:\WINDOWS\system32\hgGxYQjG.dll
C:\WINDOWS\system32\iifgFVpq.dll
C:\WINDOWS\system32\jkklliGW.dll
C:\WINDOWS\system32\khfDspqQ.dll
C:\WINDOWS\system32\khfEUnND.dll
C:\WINDOWS\system32\ljJCrPIA.dll
C:\WINDOWS\system32\lsprst7.dll
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\system32\mlJaASMG.dll
C:\WINDOWS\system32\mlJDVoLE.dll
C:\WINDOWS\system32\mlJYomKd.dll
C:\WINDOWS\system32\nnnMFwTN.dll
C:\WINDOWS\system32\nnnNeDwW.dll
C:\WINDOWS\system32\opnlMFyW.dll
C:\WINDOWS\system32\opnMgeBQ.dll
C:\WINDOWS\system32\pmnnLcdD.dll
C:\WINDOWS\system32\qoMdAQGX.dll
C:\WINDOWS\system32\qoMdAQhf.dll
C:\WINDOWS\system32\qpVFgfii.ini
C:\WINDOWS\system32\qpVFgfii.ini2
C:\WINDOWS\system32\rqRLdAsP.dll
C:\WINDOWS\system32\ssprs.dll
C:\WINDOWS\system32\ssqNGXRJ.dll
C:\WINDOWS\system32\ssqOIYRI.dll
C:\WINDOWS\system32\ssqQkJbb.dll
C:\WINDOWS\system32\tuvTlkkl.dll
C:\WINDOWS\system32\urqRKebC.dll
C:\WINDOWS\system32\vtUkiffe.dll
C:\WINDOWS\system32\vtUkjJBR.dll
C:\WINDOWS\system32\wvUmkjGV.dll
C:\WINDOWS\system32\xxyVOigd.dll
C:\WINDOWS\system32\yayvSjHW.dll
C:\WINDOWS\system32\yayxvUkK.dll
C:\WINDOWS\Web\default.htt
.
((((((((((((((((((((((((( Pliki utworzone od 2008-09-23 do 2008-10-23 )))))))))))))))))))))))))))))))
.
2008-10-23 22:04 . 2004-08-04 02:44 1,033,728 --a------ C:\WINDOWS\explorer.exe
2008-10-23 17:58 . 2004-08-04 14:00 426,041 --a--c--- C:\WINDOWS\system32\dllcache\voicepad.dll
2008-10-23 17:58 . 2004-08-04 14:00 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winzm.ime
2008-10-23 17:58 . 2004-08-04 14:00 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winsp.ime
2008-10-23 17:58 . 2004-08-04 14:00 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winpy.ime
2008-10-23 17:58 . 2004-08-04 14:00 86,073 --a--c--- C:\WINDOWS\system32\dllcache\voicesub.dll
2008-10-23 17:58 . 2004-08-04 14:00 79,360 --a--c--- C:\WINDOWS\system32\dllcache\winar30.ime
2008-10-23 17:58 . 2004-08-04 14:00 69,120 --a--c--- C:\WINDOWS\system32\dllcache\wingb.ime
2008-10-23 17:58 . 2004-08-04 14:00 65,536 --a--c--- C:\WINDOWS\system32\dllcache\winime.ime
2008-10-23 17:58 . 2004-08-04 14:00 48,256 --a--c--- C:\WINDOWS\system32\dllcache\w32.dll
2008-10-23 17:58 . 2004-08-04 14:00 41,600 --a--c--- C:\WINDOWS\system32\dllcache\weitekp9.dll
2008-10-23 17:58 . 2004-08-04 14:00 31,360 --a--c--- C:\WINDOWS\system32\dllcache\weitekp9.sys
2008-10-23 17:58 . 2004-08-04 14:00 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls
2008-10-23 17:56 . 2004-08-04 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-10-23 17:55 . 2004-08-04 14:00 1,677,824 --a--c--- C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-10-23 17:52 . 2008-10-23 17:52 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-10-23 17:52 . 2008-10-23 17:52 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-10-23 17:52 . 2008-10-23 17:52 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-10-23 17:52 . 2008-10-23 17:52 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-10-23 17:52 . 2008-10-23 17:52 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-10-23 17:51 . 2004-08-04 14:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe
2008-10-23 17:35 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2008-10-22 19:09 . 2008-10-22 19:09 116,942,946 --a------ C:\BackupRegistry(20081022).reg
2008-10-22 18:13 . 2008-10-22 18:20 <DIR> d-------- C:\[u]0[/u]4b0da5d61855af9c742a32d1f
2008-10-21 07:56 . 2008-10-21 07:56 2,290 --a------ C:\WINDOWS\system32\ddcCrPHA.dll
2008-10-21 06:56 . 2008-10-21 06:56 2,290 --a------ C:\WINDOWS\system32\ddcCUnkk.dll
2008-10-20 22:06 . 2008-10-23 08:39 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-20 22:06 . 2008-10-20 22:06 1,409 --a------ C:\WINDOWS\QTFont.for
2008-10-06 10:41 . 2004-02-27 07:04 38,771 --a------ C:\WINDOWS\hpomdl03.dat
2008-10-06 10:41 . 2008-10-06 10:49 29,700 --a------ C:\WINDOWS\hpoins03.dat
2008-10-02 08:37 . 2008-10-02 08:37 941,696 --a------ C:\FRAGLIST.HTM
2008-10-02 08:36 . 2008-10-02 08:38 3,565,343 --a------ C:\FRAGLIST.LUAR
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-23 18:47 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-10-23 16:51 --------- d-----w C:\Documents and Settings\Jacek\Dane aplikacji\U3
2008-10-23 13:46 --------- d-----w C:\Documents and Settings\Jacek\Dane aplikacji\OpenOffice.ux.pl2
2008-10-23 08:08 --------- d-----w C:\Program Files\PC Tools Internet Security
2008-10-22 20:21 --------- d-----w C:\Documents and Settings\Jacek\Dane aplikacji\FileZilla
2008-10-22 16:49 --------- d-----w C:\Documents and Settings\Jacek\Dane aplikacji\DNA
2008-10-22 16:34 --------- d-----w C:\Documents and Settings\Jacek\Dane aplikacji\BitTorrent
2008-10-20 17:36 --------- d-----w C:\Program Files\PeerGuardian2
2008-10-15 05:13 --------- d-----w C:\Program Files\OpenOfficePL3.0.1
2008-09-26 14:07 --------- d-----w C:\Program Files\Ashampoo
2008-08-25 09:00 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-13 13:51 110,386,526 ----a-w C:\BackupRegistry(20080813).reg
2008-02-14 09:17 308 ----a-w C:\Documents and Settings\Jacek\Dane aplikacji\wklnhst.dat
2008-02-10 06:36 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-12 11:08 4,059 ----a-w C:\Program Files\Gyula's NavigatorPEX.PhoneExplorer.txt
2005-02-07 14:39 893 ----a-w C:\Documents and Settings\Jacek\OOo_dictionary_list.dat
2004-12-22 10:17 11,079 ---ha-w C:\Program Files\folder.htt
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 2111176]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-12-10 86016]
"IntelliType"="C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" [2002-03-22 94208]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)
"NoAutoTrayNotify"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EnableBalloonTips"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoRecentDocsNetHood"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
"VIDC.SP50"= SP5X_32.DLL
"VIDC.SP51"= SP5X_32.DLL
"VIDC.SP52"= SP5X_32.DLL
"VIDC.SP53"= SP5X_32.DLL
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^hp psc 2000 Series.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Photo Loader supervisory.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^Jacek^Menu Start^Programy^Autostart^Neostrada Plus.lnk]
backup=C:\WINDOWS\pss\Neostrada Plus.lnkStartup
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="C:\Documents and Settings\Jacek\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WinFast Schedule"=C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Lit\\lit.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\X-Lite\\X-Lite.exe"=
"C:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\SJLabs\\SJphone\\SJphone.exe"=
"C:\\Garmin\\UMP-pcPL\\rsync.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\WINDOWS\\system32\\mshta.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 hotcore2;hotcore2;C:\WINDOWS\system32\drivers\hotcore2.sys [2006-10-02 30808]
R0 isdnlink;isdnlink;C:\WINDOWS\system32\DRIVERS\linkisdn.sys [2001-07-03 510803]
R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-03-04 159144]
R1 pctmp;PC Tools Firewall Memory Protection Driver;C:\WINDOWS\system32\drivers\pctmp.sys [2007-11-30 40872]
R1 pctssipc;PC Tools Security Suite IPC Driver;C:\WINDOWS\system32\drivers\pctssipc.sys [2007-11-30 18344]
R2 OkiPar;OkiPar;C:\WINDOWS\system32\DRIVERS\OKIPAR.SYS [2001-10-02 40192]
S2 BT848;WinFast TV2000 XP WDM Video Capture;C:\WINDOWS\system32\drivers\wf2kvcap.sys [2004-07-22 75925]
S2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;C:\WINDOWS\system32\drivers\wf2ktunr.sys [2004-07-22 36583]
S2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;C:\WINDOWS\system32\drivers\wf2kxbar.sys [2004-07-22 10005]
S3 BioNT_BS;BioNT_BS;C:\Program Files\Paragon Software\Partition Manager\bluescrn\BioNT_bs.sys [ ]
S3 CA504AV;Mega Camera, WDM Video Capture;C:\WINDOWS\system32\Drivers\CA504AV.SYS [2002-01-30 517941]
S3 Sunplus;Mega Camera Still Image Capture, Sunplus Version 1.00;C:\WINDOWS\system32\Drivers\Bulk504.sys [2001-10-05 10952]
S3 ultradfg;ultradfg;C:\WINDOWS\system32\DRIVERS\ultradfg.sys [2008-03-09 23040]
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSHGX;SHARP GSM GPRS USB Driver 1.0.0;C:\WINDOWS\system32\DRIVERS\usbshgx.sys [2004-01-26 24048]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 wanlink;wanlink;C:\WINDOWS\system32\DRIVERS\wanlink.sys [2001-07-03 28176]
S3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFTVFM\WFIOCTL.SYS [2003-09-10 9510]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c6b77a9e-0bba-11dd-8a53-101111111111}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
.
Zawartość folderu 'Zaplanowane zadania'
2008-10-23 C:\WINDOWS\Tasks\Archiwum Diino - Jacek - moje dokumenty do archiwizacji.Full.job
- C:\Program Files\Diino\DiinoBackupAgent.exe [2008-06-30 11:58]
2008-10-23 C:\WINDOWS\Tasks\Archiwum Diino - Jacek - moje dokumenty do archiwizacji.Incremental.job
- C:\Program Files\Diino\DiinoBackupAgent.exe [2008-06-30 11:58]
2008-10-23 C:\WINDOWS\Tasks\Archiwum Diino - Jacek - moje.Full.job
- C:\Program Files\Diino\DiinoBackupAgent.exe [2008-06-30 11:58]
2008-10-23 C:\WINDOWS\Tasks\Archiwum Diino - Jacek - moje.Incremental.job
- C:\Program Files\Diino\DiinoBackupAgent.exe [2008-06-30 11:58]
2008-10-23 C:\WINDOWS\Tasks\GoogleUpdateTaskUser.job
- C:\Documents and Settings\Jacek\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-09-03 08:29]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
BHO-{69A061E9-006E-4FE6-B817-866A11053C76} - C:\WINDOWS\system32\iifgFVpq.dll
BHO-{FBFD382A-AC6E-4EB7-8944-F97D358B378D} - C:\WINDOWS\SYSTEM32\awtutsqQ.dll
HKLM-Run-DXDllRegExe - dxdllreg.exe
ShellExecuteHooks-{FBFD382A-AC6E-4EB7-8944-F97D358B378D} - C:\WINDOWS\SYSTEM32\awtutsqQ.dll
MSConfigStartUp-windows auto update - msblast.exe
.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\Jacek\Dane aplikacji\Mozilla\Firefox\Profiles\jed2g47m.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.allegro.pl/
FF -: plugin - C:\Documents and Settings\Jacek\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.131.25\npGoogleOneClick6.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
FF -: plugin - C:\WINDOWS\SYSTEM32\Cult3D\NPMCult3DP.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-23 20:52:43
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
C:\PROGRA~1\Microsoft ActiveSync\rapimgr.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
.
**************************************************************************
.
Czas ukończenia: 2008-10-23 20:54:24 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2008-10-23 18:54:20
Przed: 127 556 157 440 bajtów wolnych
Po: 127,523,037,184 bajtów wolnych
WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /noguiboot /noexecute=optin
269 --- E O F --- 2008-10-22 16:26:14
oraz:
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:07:06, on 2008-10-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\Microsoft ActiveSync\rapimgr.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\Program Files\PC Tools Internet Security\pctsAuxs.exe
C:\Program Files\PC Tools Internet Security\pctsSvc.exe
C:\Program Files\PC Tools Internet Security\pctsTray.exe
C:\Documents and Settings\Jacek\Pulpit\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazetawyborcza.pl/0,0.html?p=4
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\PC Tools Internet Security\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {8626DFA9-2BAC-4BDA-8663-8DAA0F942C0D} - http://netpanel.gem.pl/netpanel2/temp/netp/7069/1169/2637/2700/7069116926372700.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools Internet Security\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools Internet Security\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O24 - Desktop Component 0: (no name) - http://www.twoje-sudety.com.pl/admin/gfx/news/42d.jpg
O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/Jacek/USTAWI~1/Temp/msoclip1/01/clip_image001.jpg
--
End of file - 5841 bytes
Za każdą pomoc z góry dzięki
