bardzo prosze o pomoc,
log:
ComboFix 08-07-27.5 - Kasia 2008-07-28 15:09:30.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.104 [GMT 2:00]
Running from: C:\Documents and Settings\Kasia\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kasia\Pulpit\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-28 )))))))))))))))))))))))))))))))
.
2008-07-28 14:35 . 2008-07-28 14:40
2008-07-27 10:30 . 2008-07-27 10:31
2008-07-27 10:27 . 2008-07-27 10:27
2008-07-25 10:10 . 2008-07-25 10:11 38 --a------ C:\WINDOWS\avisplitter.INI
2008-07-25 09:56 . 2008-07-25 09:56
2008-07-25 09:55 . 2008-07-25 09:56
2008-07-25 09:55 . 2008-07-25 09:56
2008-07-25 09:55 . 2008-07-25 09:55
2008-07-25 09:55 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-07-25 09:51 . 2008-07-25 09:52
2008-07-24 08:58 . 2008-07-24 08:58 68,608 --ah----- C:\WINDOWS\system32\nmba.exe
2008-07-16 05:15 . 2008-07-16 05:15 91,136 --ah----- C:\WINDOWS\system32\ofge.exe
2008-07-06 18:44 . 2008-07-06 18:44 63,488 --ah----- C:\WINDOWS\system32\pmub.exe
2008-07-06 08:56 . 2008-07-06 08:56 63,488 --ah----- C:\WINDOWS\system32\rhvhalez.exe
2008-07-05 16:39 . 2008-07-05 16:39 0 -ra------ C:\WINDOWS\system32\TFTP1336
2008-07-04 17:36 . 2008-07-04 17:36
2008-07-04 17:36 . 2008-06-08 23:58 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2008-07-04 00:37 . 2008-07-04 00:38 57,344 --ah----- C:\WINDOWS\system32\hnidth.exe
2008-07-02 17:15 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-07-02 17:15 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\system32\lameACM.acm
2008-07-02 17:15 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2008-07-02 17:15 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\system32\unrar.dll
2008-07-02 17:15 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-07-02 17:15 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm
2008-07-02 17:15 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\system32\lame_acm.xml
2008-07-02 17:14 . 2008-07-02 17:14
2008-07-02 17:14 . 2007-11-29 23:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-07-02 17:14 . 2007-12-04 02:33 682,496 --a------ C:\WINDOWS\system32\divx.dll
2008-07-02 17:14 . 2007-11-29 23:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll
2008-07-02 17:14 . 2008-06-12 20:36 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-07-02 17:14 . 2007-07-10 18:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-07-02 17:11 . 2008-07-02 17:11 63,488 --ah----- C:\WINDOWS\system32\mldo.exe
2008-07-02 17:04 . 2008-07-02 17:17
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-28 12:28 --------- d-----w C:\Documents and Settings\Kasia\Dane aplikacji\uTorrent
2008-07-27 13:38 --------- d-----w C:\Program Files\IrfanView
2008-07-08 14:00 --------- d-----w C:\Program Files\Opera
2008-07-02 15:02 --------- d-----w C:\Program Files\Winamp
2008-07-02 15:02 --------- d-----w C:\Program Files\realalt
2008-06-06 16:06 --------- d-----w C:\Program Files\Zuma Deluxe
2008-06-05 14:45 --------- d-----w C:\Program Files\GameHouse
2008-06-01 12:21 --------- d-----w C:\Documents and Settings\Kasia\Dane aplikacji\MSN6
2008-06-01 12:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\MSN6
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Gadu-Gadu”=“C:\Program Files\gg\Gadu-Gadu\gg.exe” [2007-07-09 09:39 2119104]
“swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2008-04-17 14:48 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-10-10 20:51 39792]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 15:00 79224]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe” [2008-02-22 04:25 144784]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2002-09-29 00:00 13312]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
“VIDC.YV12”= yv12vfw.dll
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-28 15:11:02
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-28 15:13:25
ComboFix-quarantined-files.txt 2008-07-28 13:12:30
ComboFix2.txt 2008-07-28 13:06:47
ComboFix3.txt 2008-07-28 12:57:21
Pre-Run: 4,820,414,464 bajtów wolnych
Post-Run: 4,809,957,376 bajtów wolnych
93