Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:29:46, on 2009-02-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
 
Running processes:
C:\\WINDOWS\\System32\\smss.exe
C:\\WINDOWS\\system32\\winlogon.exe
C:\\WINDOWS\\system32\\services.exe
C:\\WINDOWS\\system32\\lsass.exe
C:\\WINDOWS\\system32\\svchost.exe
C:\\Program Files\\Windows Defender\\MsMpEng.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\Program Files\\Alwil Software\\Avast4\\aswUpdSv.exe
C:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe
C:\\WINDOWS\\system32\\spoolsv.exe
C:\\WINDOWS\\ehome\\ehtray.exe
C:\\WINDOWS\\system32\\RUNDLL32.EXE
C:\\Program Files\\Alwil Software\\Avast4\\ashDisp.exe
E:\\Creative\\Creative Live! Cam\\VideoFX\\StartFX.exe
C:\\WINDOWS\\system32\\V0230Mon.exe
C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe
C:\\Program Files\\Windows Defender\\MSASCui.exe
C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe
D:\\DialNet\\winpppoverethernet.exe
C:\\WINDOWS\\system32\\ctfmon.exe
D:\\DAEMON Tools Lite\\daemon.exe
C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe
C:\\WINDOWS\\system32\\CTsvcCDA.exe
C:\\WINDOWS\\eHome\\ehRecvr.exe
C:\\WINDOWS\\eHome\\ehSched.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\WINDOWS\\system32\\nvsvc32.exe
C:\\WINDOWS\\system32\\HPZipm12.exe
C:\\WINDOWS\\system32\\PnkBstrA.exe
C:\\WINDOWS\\system32\\svchost.exe
D:\\DialNet\\WrOS.EXE
C:\\WINDOWS\\system32\\dllhost.exe
C:\\WINDOWS\\eHome\\ehmsas.exe
E:\\Ochrona darmowa\\Sunbelt Software\\Personal Firewall\\kpf4ss.exe
E:\\Ochrona darmowa\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe
E:\\Ochrona darmowa\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe
C:\\WINDOWS\\system32\\wscntfy.exe
C:\\WINDOWS\\explorer.exe
E:\\Ochrona darmowa\\nowy This\\HijackThis.exe
 
R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.onet.pl/
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66028
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\\Software\\Microsoft\\Internet Connection Wizard,ShellNext = http://www.vobis.pl/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\\Program Files\\Adobe\\Acrobat 7.0\\ActiveX\\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\\ochrona darmowa1\\Spybot - Search & Destroy\\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\\Program Files\\Java\\jre1.5.0_08\\bin\\ssv.dll
O4 - HKLM\\..\\Run: [ehTray] C:\\WINDOWS\\ehome\\ehtray.exe
O4 - HKLM\\..\\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\\..\\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\\..\\Run: [UpdReg] C:\\WINDOWS\\UpdReg.EXE
O4 - HKLM\\..\\Run: [NvCplDaemon] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup
O4 - HKLM\\..\\Run: [nwiz] nwiz.exe /install
O4 - HKLM\\..\\Run: [NvMediaCenter] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\\..\\Run: [avast!] \"C:\\Program Files\\Alwil Software\\Avast4\\ashDisp.exe\"
O4 - HKLM\\..\\Run: [AVFX Engine] e:\\Creative\\Creative Live! Cam\\VideoFX\\StartFX.exe
O4 - HKLM\\..\\Run: [V0230Mon.exe] C:\\WINDOWS\\system32\\V0230Mon.exe
O4 - HKLM\\..\\Run: [NeroFilterCheck] C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe
O4 - HKLM\\..\\Run: [HP Software Update] C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe
O4 - HKLM\\..\\Run: [TkBellExe] \"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot
O4 - HKLM\\..\\Run: [a-winpoet-service] D:\\DialNet\\winpppoverethernet.exe
O4 - HKCU\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\ctfmon.exe
O4 - HKCU\\..\\Run: [DAEMON Tools Lite] \"D:\\DAEMON Tools Lite\\daemon.exe\" -autorun
O4 - HKCU\\..\\Run: [WMPNSCFG] C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe
O4 - HKUS\\S-1-5-18\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'SYSTEM\')
O4 - HKUS\\S-1-5-18\\..\\Run: [DWQueuedReporting] \"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t (User \'SYSTEM\')
O4 - HKUS\\.DEFAULT\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'Default user\')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\\PROGRA~1\\Microsoft Office\\OFFICE11\\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_08\\bin\\ssv.dll
O9 - Extra \'Tools\' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_08\\bin\\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\\PROGRA~1\\Microsoft Office\\OFFICE11\\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\\ochrona darmowa1\\Spybot - Search & Destroy\\SDHelper.dll
O9 - Extra \'Tools\' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\\ochrona darmowa1\\Spybot - Search & Destroy\\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe
O9 - Extra \'Tools\' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe
O9 - Extra \'Tools\' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.vobis.pl/
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229339481906
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{135BB3E1-FCF6-4553-997E-D500635FBB13}: NameServer = 217.30.129.149,217.30.137.200
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\\PROGRA~1\\Crawler\\ctbr.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\\Program Files\\Alwil Software\\Avast4\\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\\Program Files\\Alwil Software\\Avast4\\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\\WINDOWS\\system32\\CTsvcCDA.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - E:\\Ochrona darmowa\\Sunbelt Software\\Personal Firewall\\kpf4ss.exe
O23 - Service: NBService - Nero AG - C:\\Program Files\\Nero\\Nero 7\\Nero BackItUp\\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\\WINDOWS\\system32\\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\\WINDOWS\\system32\\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\\WINDOWS\\system32\\PnkBstrA.exe
O23 - Service: Wildlife Park 2 AddOn3 Marine Park Drivers Auto Removal (pr2alucb) (pr2alucb) - Koch Media - C:\\WINDOWS\\system32\\pr2alucb.exe
O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - D:\\DialNet\\WrOS.EXE
 
--
End of file - 7677 bytes