Witam Oto mój problem.
Przez przypadek zainstalowało mi sie to cos --->WebSiteViewer i nie wiem jak to wywalic nie moge zmienic strony startowej bo ciagle wlacza mi sie ta ---->http://213.159.117.134/index.php
pomozcie!!! nie wiem co robic
jakis XXX ciagle mam na pulpicie nie wiem jak sie tego pozbyc pomocy
Proszę o sprawdzenie mojego loga w HiJacku
Logfile of HijackThis v1.99.1
Scan saved at 12:58:33, on 2005-03-12
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:/WINDOWS/System32/smss.exe
C:/WINDOWS/system32/winlogon.exe
C:/WINDOWS/system32/services.exe
C:/WINDOWS/system32/lsass.exe
C:/WINDOWS/system32/svchost.exe
C:/WINDOWS/System32/svchost.exe
C:/Program Files/Common Files/Symantec Shared/ccEvtMgr.exe
C:/WINDOWS/Explorer.EXE
C:/WINDOWS/system32/spoolsv.exe
C:/Program Files/Common Files/Symantec Shared/ccApp.exe
C:/Program Files/Norton SystemWorks/Norton Ghost/GhostStartTrayApp.exe
C:/Program Files/QuickTime/qttask.exe
C:/WINDOWS/System32/ymjnnzzg.exe
C:/temp/msbb.exe
C:/Program Files/ISTsvc/istsvc.exe
C:/Program Files/Internet Optimizer/optimize.exe
C:/Program Files/Java/j2re1.4.2_05/bin/jusched.exe
C:/Program Files/DelFin/PromulGate/PgMonitr.exe
C:/Program Files/Internet Optimizer/actalert.exe
C:/Program Files/DownloadWare/dw.exe
C:/WINDOWS/System32/rundll32.exe
C:/Program Files/Internet Optimizer/actalert.exe
C:/WINDOWS/mnfddw.exe
C:/Program Files/Winamp/winampa.exe
C:/WINDOWS/System32/systime.exe
C:/Program Files/Embutav/Ipwrp.exe
C:/WINDOWS/System32/bdebkup.exe
C:/Program Files/AutoUpdate/AutoUpdate.exe
C:/WINDOWS/msmsgr2.exe
C:/Program Files/Messenger/msmsgs.exe
C:/WINDOWS/System32/systime.exe
C:/WINDOWS/System32/atrninst.exe
C:/WINDOWS/System32/cisvc.exe
C:/Program Files/Kodak/KODAK Software Updater/7288971/Program/Kodak Software Updater.exe
C:/WINDOWS/SYSTEM32/GEARSEC.EXE
C:/Program Files/Kodak/Kodak EasyShare software/bin/EasyShare.exe
C:/Program Files/Norton SystemWorks/Norton Ghost/GhostStartService.exe
C:/WINDOWS/system32/drivers/KodakCCS.exe
C:/Program Files/Norton SystemWorks/Norton AntiVirus/navapsvc.exe
C:/Program Files/Norton SystemWorks/Norton Utilities/NPROTECT.EXE
C:/WINDOWS/System32/nvsvc32.exe
C:/WINDOWS/System32/ScsiAccess.EXE
C:/PROGRA~1/NORTON~1/SPEEDD~1/nopdb.exe
C:/WINDOWS/System32/svchost.exe
C:/Program Files/CxtPls/CxtPls.exe
C:/WINDOWS/System32/wuauclt.exe
C:/WINDOWS/System32/cidaemon.exe
C:/PROGRA~1/RECOMM~1/v15/rh.exe
D:/GG/Gadu-Gadu/gg.exe
C:/Program Files/Internet Explorer/IEXPLORE.EXE
C:/DOCUME~1/ADMINI~1/USTAWI~1/Temp/sa8.tmp.exe
C:/Program Files/Internet Explorer/IEXPLORE.EXE
D:/Jozef/Anty Szpieg/HijackThis.exe
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Default_Page_URL = http://213.159.117.134/index.php
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=56715
R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://213.159.117.134/index.php
R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Default_Page_URL = http://213.159.117.134/index.php
R0 - HKLM/Software/Microsoft/Internet Explorer/Main,Start Page = http://213.159.117.134/index.php
R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=56715
R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Local Page = http://213.159.117.134/index.php
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page_bak = http://www.onet.pl/
R0 - HKLM/Software/Microsoft/Internet Explorer/Main,Local Page = http://213.159.117.134/index.php
R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 127.0.0.3 www.greg-tut.com
O1 - Hosts: 127.0.0.3 nylonsexy.com
O1 - Hosts: 127.0.0.3 www.nylonsexy.com
O1 - Hosts: 127.0.0.3 vparivalka.com
O1 - Hosts: 127.0.0.3 www.vparivalka.comtoescrowpay.com
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 newiframe.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 pizdato.biz
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 buldog-stats.com
O1 - Hosts: 127.0.0.3 www.buldog-stats.com
O1 - Hosts: 127.0.0.3 fregat.drocherway.com
O1 - Hosts: 127.0.0.3 slutmania.biz
O1 - Hosts: 127.0.0.3 www.slutmania.biz
O1 - Hosts: 127.0.0.3 toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.megapornix.com
O1 - Hosts: 127.0.0.3 megapornix.com
O1 - Hosts: 127.0.0.3 www.sp2fucked.biz
O1 - Hosts: 127.0.0.3 sp2fucked.biz
O1 - Hosts: 127.0.0.3 greg-tut.com
O1 - Hosts: http://213.159.117.203/dkprogs/hosts.txt
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:/WINDOWS/nem220.dll
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:/WINDOWS/localNRD.dll
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:/Program Files/CxtPls/cxtpls.dll
O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:/Program Files/Recommended Hotfix - 421701D/v15/RH.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Program Files/Adobe/Acrobat 6.0 CE/Reader/ActiveX/AcroIEHelper.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:/Program Files/NewDotNet/newdotnet6_38.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:/WINDOWS/2_0_1browserhelper2.dll
O2 - BHO: MediaLoads Enhanced - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:/Program Files/MediaLoads Enhanced/ME2.DLL
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:/Program Files/SideFind/sfbho13.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:/Program Files/Norton SystemWorks/Norton AntiVirus/NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:/Program Files/Norton SystemWorks/Norton AntiVirus/NavShExt.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:/Program Files/ISTbar/istbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx
O4 - HKLM/../Run: [ccApp] C:/Program Files/Common Files/Symantec Shared/ccApp.exe
O4 - HKLM/../Run: [ccRegVfy] C:/Program Files/Common Files/Symantec Shared/ccRegVfy.exe
O4 - HKLM/../Run: [GhostStartTrayApp] C:/Program Files/Norton SystemWorks/Norton Ghost/GhostStartTrayApp.exe
O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM/../Run: [QuickTime Task] "C:/Program Files/QuickTime/qttask.exe" -atboottime
O4 - HKLM/../Run: [hsezaipn] C:/WINDOWS/System32/ymjnnzzg.exe
O4 - HKLM/../Run: [msbb] c:/temp/msbb.exe
O4 - HKLM/../Run: [conscorr] C:/WINDOWS/conscorr.exe
O4 - HKLM/../Run: [ozuhsb] C:/WINDOWS/ozuhsb.exe
O4 - HKLM/../Run: [IST Service] C:/Program Files/ISTsvc/istsvc.exe
O4 - HKLM/../Run: [Internet Optimizer] "C:/Program Files/Internet Optimizer/optimize.exe"
O4 - HKLM/../Run: [SunJavaUpdateSched] C:/Program Files/Java/j2re1.4.2_05/bin/jusched.exe
O4 - HKLM/../Run: [PromulGate] "C:/Program Files/DelFin/PromulGate/PgMonitr.exe"
O4 - HKLM/../Run: [MediaLoads Installer] "C:/Program Files/DownloadWare/dw.exe" /H
O4 - HKLM/../Run: [New.net Startup] rundll32 C:/PROGRA~1/NEWDOT~1/NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM/../Run: [AamFXDF] C:/WINDOWS/mnfddw.exe
O4 - HKLM/../Run: [Agoojhv] C:/Program Files/Mhrcy/Ofzsx.exe
O4 - HKLM/../Run: [Aamú" ‹üžigĹY]vGď€C:/Program Files/ISTsvc/istsvc.exe] C:/WINDOWS/mnfddw.exe
O4 - HKLM/../Run: [NeroFilterCheck] C:/WINDOWS/system32/NeroCheck.exe
O4 - HKLM/../Run: [WinampAgent] C:/Program Files/Winamp/winampa.exe
O4 - HKLM/../Run: [SysTime] C:/WINDOWS/System32/systime.exe
O4 - HKLM/../Run: [Onuegzjn] C:/Program Files/Embutav/Ipwrp.exe
O4 - HKLM/../Run: [036g3pU] bdebkup.exe
O4 - HKLM/../Run: [AutoUpdater] "C:/Program Files/AutoUpdate/AutoUpdate.exe"
O4 - HKLM/../Run: [_Cat4] C:/WINDOWS/msmsgr2.exe
O4 - HKCU/../Run: [MSMSGS] "C:/Program Files/Messenger/msmsgs.exe" /background
O4 - HKCU/../Run: [Komunikator] C:/Program Files/Tlen.pl/tlen.exe
O4 - HKCU/../Run: [SysTime] C:/WINDOWS/System32/systime.exe
O4 - HKCU/../Run: [H0pmRfYFi] atrninst.exe
O4 - Startup: Kodak EasyShare software.lnk = C:/Program Files/Kodak/Kodak EasyShare software/bin/EasyShare.exe
O4 - Startup: Kodak software updater.lnk = C:/Program Files/Kodak/KODAK Software Updater/7288971/Program/Kodak Software Updater.exe
O4 - Startup: Microsoft Office.lnk = C:/Program Files/Microsoft Office/Office/OSA9.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:/Program Files/Kodak/Kodak EasyShare software/bin/EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:/Program Files/Kodak/KODAK Software Updater/7288971/Program/Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:/Program Files/Microsoft Office/Office/OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/Program Files/Java/j2re1.4.2_05/bin/npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/Program Files/Java/j2re1.4.2_05/bin/npjpi142_05.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:/Program Files/SideFind/sidefind13.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .pdf: C:/Program Files/Internet Explorer/PLUGINS/nppdf32.dll
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O18 - Filter: text/html - {6FFBBB68-A4BC-49AD-94E5-A0D041336806} - C:/Documents and Settings/Administrator/Ustawienia lokalne/Dane aplikacji/microsoft/internet explorer/V0.26.dat
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:/Program Files/Common Files/Symantec Shared/ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:/Program Files/Common Files/Symantec Shared/ccPwdSvc.exe
O23 - Service: GEARSecurity - GEAR Software - C:/WINDOWS/SYSTEM32/GEARSEC.EXE
O23 - Service: GhostStartService - Symantec Corporation - C:/Program Files/Norton SystemWorks/Norton Ghost/GhostStartService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:/WINDOWS/system32/drivers/KodakCCS.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:/Program Files/Norton SystemWorks/Norton AntiVirus/navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:/Program Files/Norton SystemWorks/Norton Utilities/NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:/WINDOWS/System32/nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:/PROGRA~1/COMMON~1/SYMANT~1/SCRIPT~1/SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:/WINDOWS/System32/ScsiAccess.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:/PROGRA~1/NORTON~1/SPEEDD~1/nopdb.
Przez przypadek zainstalowało mi sie to cos --->WebSiteViewer i nie wiem jak to wywalic nie moge zmienic strony startowej bo ciagle wlacza mi sie ta ---->http://213.159.117.134/index.php
pomozcie!!! nie wiem co robic
jakis XXX ciagle mam na pulpicie nie wiem jak sie tego pozbyc pomocy
Proszę o sprawdzenie mojego loga w HiJacku
Logfile of HijackThis v1.99.1
Scan saved at 12:58:33, on 2005-03-12
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:/WINDOWS/System32/smss.exe
C:/WINDOWS/system32/winlogon.exe
C:/WINDOWS/system32/services.exe
C:/WINDOWS/system32/lsass.exe
C:/WINDOWS/system32/svchost.exe
C:/WINDOWS/System32/svchost.exe
C:/Program Files/Common Files/Symantec Shared/ccEvtMgr.exe
C:/WINDOWS/Explorer.EXE
C:/WINDOWS/system32/spoolsv.exe
C:/Program Files/Common Files/Symantec Shared/ccApp.exe
C:/Program Files/Norton SystemWorks/Norton Ghost/GhostStartTrayApp.exe
C:/Program Files/QuickTime/qttask.exe
C:/WINDOWS/System32/ymjnnzzg.exe
C:/temp/msbb.exe
C:/Program Files/ISTsvc/istsvc.exe
C:/Program Files/Internet Optimizer/optimize.exe
C:/Program Files/Java/j2re1.4.2_05/bin/jusched.exe
C:/Program Files/DelFin/PromulGate/PgMonitr.exe
C:/Program Files/Internet Optimizer/actalert.exe
C:/Program Files/DownloadWare/dw.exe
C:/WINDOWS/System32/rundll32.exe
C:/Program Files/Internet Optimizer/actalert.exe
C:/WINDOWS/mnfddw.exe
C:/Program Files/Winamp/winampa.exe
C:/WINDOWS/System32/systime.exe
C:/Program Files/Embutav/Ipwrp.exe
C:/WINDOWS/System32/bdebkup.exe
C:/Program Files/AutoUpdate/AutoUpdate.exe
C:/WINDOWS/msmsgr2.exe
C:/Program Files/Messenger/msmsgs.exe
C:/WINDOWS/System32/systime.exe
C:/WINDOWS/System32/atrninst.exe
C:/WINDOWS/System32/cisvc.exe
C:/Program Files/Kodak/KODAK Software Updater/7288971/Program/Kodak Software Updater.exe
C:/WINDOWS/SYSTEM32/GEARSEC.EXE
C:/Program Files/Kodak/Kodak EasyShare software/bin/EasyShare.exe
C:/Program Files/Norton SystemWorks/Norton Ghost/GhostStartService.exe
C:/WINDOWS/system32/drivers/KodakCCS.exe
C:/Program Files/Norton SystemWorks/Norton AntiVirus/navapsvc.exe
C:/Program Files/Norton SystemWorks/Norton Utilities/NPROTECT.EXE
C:/WINDOWS/System32/nvsvc32.exe
C:/WINDOWS/System32/ScsiAccess.EXE
C:/PROGRA~1/NORTON~1/SPEEDD~1/nopdb.exe
C:/WINDOWS/System32/svchost.exe
C:/Program Files/CxtPls/CxtPls.exe
C:/WINDOWS/System32/wuauclt.exe
C:/WINDOWS/System32/cidaemon.exe
C:/PROGRA~1/RECOMM~1/v15/rh.exe
D:/GG/Gadu-Gadu/gg.exe
C:/Program Files/Internet Explorer/IEXPLORE.EXE
C:/DOCUME~1/ADMINI~1/USTAWI~1/Temp/sa8.tmp.exe
C:/Program Files/Internet Explorer/IEXPLORE.EXE
D:/Jozef/Anty Szpieg/HijackThis.exe
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Default_Page_URL = http://213.159.117.134/index.php
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=56715
R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://213.159.117.134/index.php
R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Default_Page_URL = http://213.159.117.134/index.php
R0 - HKLM/Software/Microsoft/Internet Explorer/Main,Start Page = http://213.159.117.134/index.php
R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=56715
R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Local Page = http://213.159.117.134/index.php
R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page_bak = http://www.onet.pl/
R0 - HKLM/Software/Microsoft/Internet Explorer/Main,Local Page = http://213.159.117.134/index.php
R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 127.0.0.3 www.greg-tut.com
O1 - Hosts: 127.0.0.3 nylonsexy.com
O1 - Hosts: 127.0.0.3 www.nylonsexy.com
O1 - Hosts: 127.0.0.3 vparivalka.com
O1 - Hosts: 127.0.0.3 www.vparivalka.comtoescrowpay.com
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 newiframe.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 pizdato.biz
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 buldog-stats.com
O1 - Hosts: 127.0.0.3 www.buldog-stats.com
O1 - Hosts: 127.0.0.3 fregat.drocherway.com
O1 - Hosts: 127.0.0.3 slutmania.biz
O1 - Hosts: 127.0.0.3 www.slutmania.biz
O1 - Hosts: 127.0.0.3 toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.megapornix.com
O1 - Hosts: 127.0.0.3 megapornix.com
O1 - Hosts: 127.0.0.3 www.sp2fucked.biz
O1 - Hosts: 127.0.0.3 sp2fucked.biz
O1 - Hosts: 127.0.0.3 greg-tut.com
O1 - Hosts: http://213.159.117.203/dkprogs/hosts.txt
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:/WINDOWS/nem220.dll
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:/WINDOWS/localNRD.dll
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:/Program Files/CxtPls/cxtpls.dll
O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:/Program Files/Recommended Hotfix - 421701D/v15/RH.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Program Files/Adobe/Acrobat 6.0 CE/Reader/ActiveX/AcroIEHelper.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:/Program Files/NewDotNet/newdotnet6_38.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:/WINDOWS/2_0_1browserhelper2.dll
O2 - BHO: MediaLoads Enhanced - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:/Program Files/MediaLoads Enhanced/ME2.DLL
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:/Program Files/SideFind/sfbho13.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:/Program Files/Norton SystemWorks/Norton AntiVirus/NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:/Program Files/Norton SystemWorks/Norton AntiVirus/NavShExt.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:/Program Files/ISTbar/istbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx
O4 - HKLM/../Run: [ccApp] C:/Program Files/Common Files/Symantec Shared/ccApp.exe
O4 - HKLM/../Run: [ccRegVfy] C:/Program Files/Common Files/Symantec Shared/ccRegVfy.exe
O4 - HKLM/../Run: [GhostStartTrayApp] C:/Program Files/Norton SystemWorks/Norton Ghost/GhostStartTrayApp.exe
O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM/../Run: [QuickTime Task] "C:/Program Files/QuickTime/qttask.exe" -atboottime
O4 - HKLM/../Run: [hsezaipn] C:/WINDOWS/System32/ymjnnzzg.exe
O4 - HKLM/../Run: [msbb] c:/temp/msbb.exe
O4 - HKLM/../Run: [conscorr] C:/WINDOWS/conscorr.exe
O4 - HKLM/../Run: [ozuhsb] C:/WINDOWS/ozuhsb.exe
O4 - HKLM/../Run: [IST Service] C:/Program Files/ISTsvc/istsvc.exe
O4 - HKLM/../Run: [Internet Optimizer] "C:/Program Files/Internet Optimizer/optimize.exe"
O4 - HKLM/../Run: [SunJavaUpdateSched] C:/Program Files/Java/j2re1.4.2_05/bin/jusched.exe
O4 - HKLM/../Run: [PromulGate] "C:/Program Files/DelFin/PromulGate/PgMonitr.exe"
O4 - HKLM/../Run: [MediaLoads Installer] "C:/Program Files/DownloadWare/dw.exe" /H
O4 - HKLM/../Run: [New.net Startup] rundll32 C:/PROGRA~1/NEWDOT~1/NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM/../Run: [AamFXDF] C:/WINDOWS/mnfddw.exe
O4 - HKLM/../Run: [Agoojhv] C:/Program Files/Mhrcy/Ofzsx.exe
O4 - HKLM/../Run: [Aamú" ‹üžigĹY]vGď€C:/Program Files/ISTsvc/istsvc.exe] C:/WINDOWS/mnfddw.exe
O4 - HKLM/../Run: [NeroFilterCheck] C:/WINDOWS/system32/NeroCheck.exe
O4 - HKLM/../Run: [WinampAgent] C:/Program Files/Winamp/winampa.exe
O4 - HKLM/../Run: [SysTime] C:/WINDOWS/System32/systime.exe
O4 - HKLM/../Run: [Onuegzjn] C:/Program Files/Embutav/Ipwrp.exe
O4 - HKLM/../Run: [036g3pU] bdebkup.exe
O4 - HKLM/../Run: [AutoUpdater] "C:/Program Files/AutoUpdate/AutoUpdate.exe"
O4 - HKLM/../Run: [_Cat4] C:/WINDOWS/msmsgr2.exe
O4 - HKCU/../Run: [MSMSGS] "C:/Program Files/Messenger/msmsgs.exe" /background
O4 - HKCU/../Run: [Komunikator] C:/Program Files/Tlen.pl/tlen.exe
O4 - HKCU/../Run: [SysTime] C:/WINDOWS/System32/systime.exe
O4 - HKCU/../Run: [H0pmRfYFi] atrninst.exe
O4 - Startup: Kodak EasyShare software.lnk = C:/Program Files/Kodak/Kodak EasyShare software/bin/EasyShare.exe
O4 - Startup: Kodak software updater.lnk = C:/Program Files/Kodak/KODAK Software Updater/7288971/Program/Kodak Software Updater.exe
O4 - Startup: Microsoft Office.lnk = C:/Program Files/Microsoft Office/Office/OSA9.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:/Program Files/Kodak/Kodak EasyShare software/bin/EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:/Program Files/Kodak/KODAK Software Updater/7288971/Program/Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:/Program Files/Microsoft Office/Office/OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/Program Files/Java/j2re1.4.2_05/bin/npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/Program Files/Java/j2re1.4.2_05/bin/npjpi142_05.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:/Program Files/SideFind/sidefind13.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .pdf: C:/Program Files/Internet Explorer/PLUGINS/nppdf32.dll
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O18 - Filter: text/html - {6FFBBB68-A4BC-49AD-94E5-A0D041336806} - C:/Documents and Settings/Administrator/Ustawienia lokalne/Dane aplikacji/microsoft/internet explorer/V0.26.dat
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:/Program Files/Common Files/Symantec Shared/ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:/Program Files/Common Files/Symantec Shared/ccPwdSvc.exe
O23 - Service: GEARSecurity - GEAR Software - C:/WINDOWS/SYSTEM32/GEARSEC.EXE
O23 - Service: GhostStartService - Symantec Corporation - C:/Program Files/Norton SystemWorks/Norton Ghost/GhostStartService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:/WINDOWS/system32/drivers/KodakCCS.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:/Program Files/Norton SystemWorks/Norton AntiVirus/navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:/Program Files/Norton SystemWorks/Norton Utilities/NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:/WINDOWS/System32/nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:/PROGRA~1/COMMON~1/SYMANT~1/SCRIPT~1/SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:/WINDOWS/System32/ScsiAccess.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:/PROGRA~1/NORTON~1/SPEEDD~1/nopdb.