proszę o sprawdzenie LOGa

[rzadki]

ComboFix 08-01-15.4 - Paweł 2008-01-18 9:41:05.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.175 [GMT 1:00]
Running from: C:\Documents and Settings\Paweł\Pulpit\ComboFix\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))
.

2008-01-17 23:31 . 2008-01-17 23:37 <DIR> d-------- C:\Program Files\English Translator 3
2008-01-17 21:56 . 2008-01-17 21:56 <DIR> d-------- C:\Program Files\D-Tools
2008-01-17 21:56 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys
2008-01-17 21:56 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys
2008-01-17 21:43 . 2008-01-17 21:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA
2008-01-17 21:40 . 2008-01-17 21:41 <DIR> d-------- C:\Program Files\Winamp
2008-01-17 21:40 . 2008-01-17 21:57 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Winamp
2008-01-17 21:36 . 2004-08-18 09:34 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-01-17 11:10 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-01-17 11:10 . 2008-01-17 11:10 421 --a------ C:\WINDOWS\ODBC.INI
2008-01-17 11:09 . 2008-01-17 11:09 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-17 11:08 . 2008-01-17 11:08 <DIR> d-------- C:\Program Files\Microsoft Works
2008-01-17 11:07 . 2008-01-17 11:09 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-01-17 10:49 . 2008-01-17 10:49 <DIR> d-------- C:\Program Files\XviD
2008-01-17 10:49 . 2005-12-30 20:10 761,856 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-01-17 10:49 . 2005-12-30 20:18 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-01-17 10:49 . 2005-12-30 20:16 77,824 --a------ C:\WINDOWS\system32\xvid.ax
2008-01-17 10:49 . 2008-01-17 23:41 1,713 --a------ C:\WINDOWS\bestplayer.ini
2008-01-17 10:49 . 2008-01-17 23:41 115 --a------ C:\WINDOWS\bestplayer.bbt
2008-01-17 10:49 . 2008-01-17 23:41 57 --a------ C:\WINDOWS\bestplayer.bpp
2008-01-17 10:48 . 2008-01-17 10:48 <DIR> d-------- C:\Program Files\Real Alternative
2008-01-17 10:48 . 2008-01-17 10:48 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-17 10:46 . 2008-01-17 10:47 <DIR> d-------- C:\Program Files\CDex_150
2008-01-17 10:45 . 2008-01-17 10:45 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-01-16 23:04 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-16 23:00 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-01-16 22:55 . 2008-01-16 22:55 <DIR> d-------- C:\Documents and Settings\Paweł\Dane aplikacji\CyberLink
2008-01-16 22:15 . 2008-01-18 09:10 3,284 --a------ C:\WINDOWS\system32\ANIWZCS{D599C670-39A6-4D44-A76D-5DF857275873}
2008-01-16 22:11 . 2008-01-16 22:11 <DIR> d-------- C:\Program Files\Audio Phonics, Inc
2008-01-16 22:10 . 1998-02-06 22:37 299,520 --a------ C:\WINDOWS\uninst.exe
2008-01-16 22:08 . 2008-01-16 22:08 <DIR> d-------- C:\Documents and Settings\Paweł\WINDOWS
2008-01-16 22:08 . 2008-01-16 22:08 <DIR> d-------- C:\Documents and Settings\Paweł\WINDOWS
2008-01-16 21:24 . 2008-01-16 21:24 <DIR> d-------- C:\Program Files\DVDFab HD Decrypter 4
2008-01-15 19:16 . 2008-01-17 23:37 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-01-15 19:04 . 2008-01-15 19:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-01-15 19:03 . 2008-01-15 19:03 <DIR> d-------- C:\Program Files\CyberLink
2008-01-15 18:58 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2008-01-15 18:58 . 2004-07-26 16:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2008-01-15 18:58 . 2004-07-26 16:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2008-01-15 18:58 . 2004-07-09 08:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll
2008-01-15 18:58 . 2004-07-26 16:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2008-01-15 18:58 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-01-15 18:58 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-01-15 18:57 . 2008-01-15 18:57 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-01-15 18:57 . 2008-01-15 18:58 <DIR> d-------- C:\Program Files\Ahead

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-16 14:57 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-15 18:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-15 12:52 --------- d-----w C:\Program Files\hp deskjet 845c series
2008-01-15 12:49 --------- d-----w C:\Program Files\Hewlett-Packard
2008-01-15 11:57 --------- d-----w C:\Documents and Settings\Paweł\Dane aplikacji\Symantec
2008-01-15 11:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-01-15 11:56 --------- d-----w C:\Program Files\Norton Internet Security
2008-01-15 11:55 --------- d-----w C:\Program Files\Symantec
2008-01-15 11:54 10,344 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys
2008-01-15 11:48 --------- d-----w C:\Program Files\Broadcom
2008-01-15 11:44 --------- d-----w C:\Program Files\ANI
2008-01-15 11:43 --------- d-----w C:\Program Files\D-Link
2008-01-15 11:43 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-15 11:37 --------- d-----w C:\Program Files\BroadCom GB LAN
2008-01-15 11:36 --------- d-----w C:\Program Files\Realtek
2008-01-15 11:33 --------- d-----w C:\Program Files\Yahoo!
2008-01-15 11:33 --------- d-----w C:\Program Files\Intel
2008-01-15 11:26 --------- d-----w C:\Program Files\microsoft frontpage
2008-01-15 11:25 --------- d-----w C:\Program Files\Usługi online
2008-01-12 07:53 106,183 --sh--r C:\d.com
.

((((((((((((((((((((((((((((( snapshot_2008-01-17_21.20.02,46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-22 16:04:56 69,120 ----a-w C:\WINDOWS\daemon.dll
+ 2007-03-07 23:51:00 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
+ 2007-03-07 23:51:00 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
+ 2007-03-07 23:51:00 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
+ 2007-03-07 23:51:00 547,576 ------w C:\WINDOWS\system32\px.dll
+ 2007-03-07 23:51:00 129,784 ------w C:\WINDOWS\system32\pxafs.dll
+ 2007-03-07 23:51:00 64,760 ------w C:\WINDOWS\system32\pxcpya64.exe
+ 2007-03-07 23:51:00 510,712 ------w C:\WINDOWS\system32\pxdrv.dll
+ 2007-03-07 23:51:00 72,440 ------w C:\WINDOWS\system32\pxhpinst.exe
+ 2007-03-07 23:51:00 64,760 ------w C:\WINDOWS\system32\pxinsa64.exe
+ 2007-03-07 23:51:00 187,128 ------w C:\WINDOWS\system32\pxmas.dll
+ 2007-03-07 23:51:00 1,628,920 ------w C:\WINDOWS\system32\pxsfs.dll
+ 2007-03-07 23:51:00 379,640 ------w C:\WINDOWS\system32\pxwave.dll
+ 2007-03-07 23:51:00 39,672 ------w C:\WINDOWS\system32\vxblock.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 07:27 16207872 C:\WINDOWS\RTHDCPL.exe]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-07-22 10:42 1519616]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-12-16 17:49 49152]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 07:27 52848]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 10:22 7618560]
"nwiz"="nwiz.exe" [2006-06-01 10:22 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 10:22 86016 C:\WINDOWS\system32\nvmctray.dll]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-09-12 17:38 196608]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22 35328]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca14404b-c538-11dc-a69c-00179a0b8bbe}]
\Shell\AutoRun\command - G:\setup.exe

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-01-15 12:02:31 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Paweł.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exef/TASK:
"2008-01-18 08:39:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 09:42:10
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-18 9:42:36
ComboFix-quarantined-files.txt 2008-01-18 08:42:33
ComboFix2.txt 2008-01-18 08:22:33
ComboFix3.txt 2008-01-17 22:25:11
ComboFix4.txt 2008-01-17 20:20:20
ComboFix5.txt 2008-01-16 22:06:21

[pp3088]

Usun:
C:\d.com
G:\setup.exe