ComboFix 08-05-01.1 - Daro 2008-05-02 13:28:48.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.162 [GMT 2:00] Running from: C:\Documents and Settings\Daro\Pulpit\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED . ((((((((((((((((((((((((( Files Created from 2008-04-02 to 2008-05-02 ))))))))))))))))))))))))))))))) . 2008-05-02 12:50 . 2008-05-02 12:50 2008-05-02 11:55 . 2008-04-27 18:19 105,128 -r-hs---- C:\oq.cmd 2008-05-02 10:40 . 2008-05-02 10:40 38 --a------ C:\WINDOWS\avisplitter.INI 2008-04-29 23:38 . 2008-04-29 23:38 2008-04-29 23:25 . 2003-07-01 18:47 9,856 --------- C:\WINDOWS\system32\drivers\pfc.sys 2008-04-29 23:24 . 2008-04-29 23:24 2008-04-29 23:23 . 2008-04-29 23:42 2008-04-29 17:30 . 2008-04-29 17:30 2008-04-29 16:54 . 2008-04-30 15:13 67 --a------ C:\WINDOWS#1 Video Converter.INI 2008-04-29 16:44 . 2008-04-29 16:44 2008-04-29 16:44 . 2008-04-29 16:44 2008-04-29 16:43 . 2008-04-29 16:43 2008-04-29 16:43 . 2008-04-29 16:44 2008-04-27 17:30 . 2008-04-27 17:30 2008-04-27 17:29 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\000001_.tmp 2008-04-25 12:07 . 2008-04-25 12:07 2008-04-25 12:06 . 2008-04-25 12:07 2008-04-22 17:25 . 2008-04-30 11:00 1,103 --a------ C:\WINDOWS\bestplayer.ini 2008-04-22 17:25 . 2008-04-30 11:00 0 --a------ C:\WINDOWS\bestplayer.bpp 2008-04-22 17:25 . 2008-04-30 11:00 0 --a------ C:\WINDOWS\bestplayer.bbt 2008-04-21 12:34 . 2008-04-21 12:34 2,359,350 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp 2008-04-21 12:34 . 2008-04-21 12:34 64,111 --a------ C:\WINDOWS\BricoPackUninst.cmd 2008-04-21 12:30 . 2008-04-21 12:30 2008-04-21 12:30 . 2008-04-21 12:34 6,112 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2008-04-18 15:55 . 2008-04-26 13:04 2008-04-18 15:53 . 2008-04-18 15:54 2008-04-18 13:24 . 2008-04-18 13:24 2008-04-18 13:23 . 2008-04-18 13:23 2008-04-18 12:56 . 2008-04-18 12:56 2008-04-18 12:55 . 2008-04-18 12:56 2008-04-18 12:55 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe 2008-04-18 12:54 . 2008-04-18 12:55 2008-04-18 12:54 . 2008-04-18 12:54 2008-04-18 12:54 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-04-18 12:54 . 2000-08-09 21:26 177,241 --a------ C:\WINDOWS\system32\APmpg4v1.apl 2008-04-18 12:54 . 2000-08-23 07:26 106,496 --a------ C:\WINDOWS\system32\APmpg4v1.dll 2008-04-18 12:06 . 2008-04-18 13:23 2008-04-18 12:05 . 2008-04-18 12:06 2008-04-18 12:05 . 2008-04-18 12:07 2008-04-18 12:03 . 2008-04-18 12:03 2008-04-18 11:42 . 2008-04-18 11:42 2008-04-18 11:24 . 2008-04-18 11:55 427 --a------ C:\WINDOWS\ODBC.INI 2008-04-18 11:24 . 2008-04-18 11:24 63 --a------ C:\WINDOWS\mdm.ini 2008-04-18 11:23 . 2008-04-18 11:23 0 --a------ C:\WINDOWS\NSREX.INI 2008-04-18 11:19 . 2008-04-18 11:19 2008-04-18 11:17 . 2008-04-18 11:54 2008-04-18 11:17 . 2008-04-18 11:41 2008-04-18 11:15 . 2008-04-18 11:15 2008-04-18 11:15 . 2008-04-18 11:15 2008-04-18 11:10 . 2008-04-18 12:14 2008-04-18 10:01 . 2008-03-01 15:02 6,066,176 -----c— C:\WINDOWS\system32\dllcache\ieframe.dll 2008-04-18 10:01 . 2007-07-01 05:31 2,455,488 -----c— C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-04-18 10:01 . 2007-07-01 05:36 1,036,288 -----c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-04-18 10:01 . 2008-03-01 15:02 459,264 -----c— C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-04-18 10:01 . 2008-03-01 15:02 383,488 -----c— C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-04-18 10:01 . 2008-03-01 15:02 267,776 -----c— C:\WINDOWS\system32\dllcache\iertutil.dll 2008-04-18 10:01 . 2008-03-01 15:02 63,488 -----c— C:\WINDOWS\system32\dllcache\icardie.dll 2008-04-18 10:01 . 2008-03-01 15:02 52,224 -----c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-04-18 10:01 . 2008-02-22 12:00 13,824 -----c— C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-18 09:59 . 2008-04-18 10:02 2008-04-17 16:53 . 2008-04-30 14:40 601 --a------ C:\WINDOWS\wcx_ftp.ini 2008-04-17 16:23 . 2004-08-03 23:08 26,496 --a–c— C:\WINDOWS\system32\dllcache\usbstor.sys 2008-04-17 16:05 . 2008-04-17 16:05 2008-04-17 16:05 . 2001-11-13 21:24 35,587 --------- C:\WINDOWS\system32\remove.exe 2008-04-17 16:05 . 2001-12-17 23:54 26,112 --a------ C:\WINDOWS\system32\drivers\aliirda.sys 2008-04-17 16:05 . 2002-01-16 17:35 24,576 --------- C:\WINDOWS\system32\ALIunFIR.exe 2008-04-17 16:04 . 2006-02-15 02:22 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys 2008-04-17 16:04 . 2006-06-14 11:00 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys 2008-04-17 16:04 . 2001-08-18 00:00 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2008-04-17 16:04 . 2004-08-04 01:07 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys 2008-04-17 16:04 . 2004-08-04 00:58 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys 2008-04-17 16:04 . 2006-06-14 10:47 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys 2008-04-17 16:04 . 2004-08-04 00:58 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2008-04-17 16:04 . 2004-08-04 00:58 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys 2008-04-17 16:04 . 2004-08-04 01:07 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys 2008-04-17 16:03 . 2006-06-14 10:47 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys 2008-04-17 16:03 . 2004-08-04 01:15 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2008-04-17 16:03 . 2004-08-04 02:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-04-17 16:03 . 2008-04-17 16:03 57,344 --a------ C:\WINDOWS\uneng.exe 2008-04-17 16:03 . 2001-08-17 23:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-04-17 16:02 . 2008-04-17 16:03 2008-04-17 16:02 . 2004-08-04 02:44 153,088 --a------ C:\WINDOWS\system32\irftp.exe 2008-04-17 16:02 . 2004-08-04 01:00 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys 2008-04-17 16:02 . 2004-08-04 02:44 27,648 --a------ C:\WINDOWS\system32\irmon.dll 2008-04-17 16:02 . 2001-08-17 23:49 26,624 --a------ C:\WINDOWS\system32\drivers\alifir.sys 2008-04-17 16:02 . 2001-08-17 23:51 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys 2008-04-17 16:02 . 2004-08-04 02:44 8,192 --a------ C:\WINDOWS\system32\wshirda.dll 2008-04-17 16:01 . 2008-04-17 16:03 2008-04-17 16:00 . 2008-04-18 10:06 1,374 --a------ C:\WINDOWS\imsins.BAK . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-02 11:10 --------- d—a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-02 07:53 --------- d-----w C:\Program Files\Spyware Doctor 2008-04-29 21:24 --------- d–h--w C:\Program Files\InstallShield Installation Information 2008-04-21 11:01 --------- d-----w C:\Documents and Settings\Daro\Dane aplikacji\Winamp 2008-04-18 09:40 --------- d-----w C:\Program Files\microsoft frontpage 2008-04-17 14:03 241,280 ----a-w C:\WINDOWS\system32\drivers\cdudf_xp.sys 2008-04-17 13:58 --------- d-----w C:\Program Files\Synaptics 2008-04-17 13:56 --------- d-----w C:\Program Files\HPQ 2008-04-17 13:55 --------- d-----w C:\Program Files\HP 2008-04-17 13:54 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-04-17 13:52 --------- d-----w C:\Documents and Settings\Daro\Dane aplikacji\Gadu-Gadu 2008-04-17 13:51 --------- d-----w C:\Program Files\CONEXANT 2008-04-17 13:45 --------- d-----w C:\Program Files\Gadu-Gadu 2008-04-17 13:45 --------- d-----w C:\Program Files\ATI Technologies 2008-04-17 13:44 --------- d-----w C:\Program Files\COMPAQ 2008-04-17 13:40 --------- d-----w C:\Program Files\Winamp 2008-04-17 13:24 --------- d-----w C:\Program Files\Zajaczek 4.1 2008-04-17 13:19 --------- d-----w C:\Documents and Settings\Daro\Dane aplikacji\PC Tools 2008-04-17 13:10 --------- d-----w C:\Program Files\Alwil Software 2008-04-17 12:28 --------- d-----w C:\Program Files\Neostrada TP 2008-04-17 12:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-04-17 12:26 --------- d-----w C:\Program Files\SAGEM 2008-04-17 12:10 --------- d-----w C:\Program Files\Usługi online 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-04 10:33 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 1999-05-17 11:58 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL 1998-12-09 00:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL 1998-12-09 00:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL 1998-12-09 00:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL 1998-12-09 00:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL 1998-12-09 00:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44 15360] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-11-14 12:54 2131392] “UberIcon”=“C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe” [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2008-03-29 19:37 79224] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2002-08-14 17:29 290816] “CARPService”=“carpserv.exe” [2003-05-21 15:35 4608 C:\WINDOWS\system32\carpserv.exe] “Display Settings”=“C:\Program Files\HPQ\Notebook Utilities\hptasks.exe” [2002-08-15 06:26 45056] “QT4HPOT”=“C:\Program Files\HPQ\One-Touch\OneTouch.EXE” [2003-01-31 05:53 106496] “SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2003-04-19 05:03 110592] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2003-04-19 04:57 610304] “ATIModeChange”=“Ati2mdxx.exe” [2002-08-16 00:18 28672 C:\WINDOWS\system32\Ati2mdxx.exe] “AdaptecDirectCD”=“C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe” [2002-12-17 12:28 684032] “CafeNews”=“C:\Program Files\CafeNews\CN.exe” [2007-06-28 14:43 1224704] “adiras”=“adiras.exe” [] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 01:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-04-18 11:10:55 113664] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-04-17 14:26:22 962661] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588] Symantec Fax Starter Edition Port.lnk - C:\Program Files\Microsoft Office\Office\1045\OLFSNT40.EXE [1999-05-17 13:59:04 46080] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “VIDC.AP41”= APmpg4v1.dll “VIDC.YV12”= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] “AntiVirusOverride”=dword:00000001 [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “C:\Program Files\Gadu-Gadu\gg.exe”= “%windir%\Network Diagnostic\xpnetdiag.exe”= “C:\totalcmd\TOTALCMD.EXE”= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] R3 ALiIRDA;ALi Infrared Device Driver;C:\WINDOWS\system32\DRIVERS\aliirda.sys [2001-12-17 23:54] R3 CALIAUD;Conexant AMC 3D ENVIRONMENTAL AUDIO;C:\WINDOWS\system32\drivers\caliaud.sys [2002-11-05 17:04] R3 CALIHALA;CALIHALA;C:\WINDOWS\system32\drivers\calihal.sys [2002-11-05 17:04] R3 FA312;Sterownik karty NETGEAR FA330/FA312/FA311 Fast Ethernet;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 22:12] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{538cbaa2-12af-11dd-9cf0-4d6564696130}] \Shell\AutoRun\command - G:\oq.cmd \Shell\explore\Command - G:\oq.cmd \Shell\open\Command - G:\oq.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{cac144d1-0c89-11dd-9ce6-4d6564696130}] \Shell\AutoRun\command - H:\USBNB.exe *Newly Created Service* - CATCHME *Newly Created Service* - PXARK . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-02 13:30:04 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-02 13:31:13 ComboFix-quarantined-files.txt 2008-05-02 11:31:08 ComboFix2.txt 2008-05-02 11:13:14 Pre-Run: 4,875,079,680 bajtów wolnych Post-Run: 4,861,435,904 bajtów wolnych 203 — E O F — 2008-04-27 15:49:38 oraz Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:32:44, on 2008-05-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\HPConfig.exe C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\carpserv.exe C:\Program Files\HPQ\One-Touch\OneTouch.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Microsoft Office\Office\1045\msoffice.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [CARPService] carpserv.exe O4 - HKLM…\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s O4 - HKLM…\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE O4 - HKLM…\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM…\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM…\Run: [AdaptecDirectCD] “C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe” O4 - HKLM…\Run: [CafeNews] C:\Program Files\CafeNews\CN.exe /autostart O4 - HKLM…\Run: [adiras] adiras.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [uberIcon] “C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe” O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1045\OLFSNT40.EXE O8 - Extra context menu item: Subskrybuj w Cafe News - C:\Program Files\CafeNews\addFeed.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip…{12B6FBA6-25B5-49B6-9A98-67884C3C5983}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe – End of file - 5827 bytes NIezmiernie prosze ludzi którzy wyznają się w tej tematyce o pomoc w pozbyciu się tego upierdliwego trojana z góry dziękuję za wszelką pomoc