ComboFix 08-04-18.3 - Pit 2008-04-20  8:00:03.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.1676 [GMT 2:00]
Running from: C:\Documents and Settings\Pit\Pulpit\ComboFix.exe
 * Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\copy.exe
C:\host.exe
C:\WINDOWS\autorun.inf
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\temp1.exe
C:\WINDOWS\system32\temp2.exe
C:\WINDOWS\xcopy.exe
D:\Autorun.inf
D:\copy.exe
D:\host.exe
E:\Autorun.inf
E:\copy.exe
E:\host.exe

.
(((((((((((((((((((((((((   Files Created from 2008-03-20 to 2008-04-20  )))))))))))))))))))))))))))))))
.

2008-04-19 16:27 . 2008-04-19 16:27	<DIR>	d--------	C:\Program Files\Opera
2008-04-17 13:31 . 2008-04-17 13:31	<DIR>	d--------	C:\Program Files\ffdshow
2008-04-17 13:31 . 2007-04-24 17:30	60,273	--a------	C:\WINDOWS\system32\pthreadGC2.dll
2008-04-17 13:31 . 2008-03-28 19:41	7,680	--a------	C:\WINDOWS\system32\ff_vfw.dll
2008-04-17 13:31 . 2007-07-10 18:10	547	--a------	C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-04-17 13:28 . 2008-04-17 13:28	<DIR>	d--------	C:\Program Files\SubEdit-Player
2008-04-17 13:18 . 2004-08-04 02:44	221,184	--a------	C:\WINDOWS\system32\wmpns.dll
2008-04-16 20:21 . 2008-02-22 02:33	69,632	--a------	C:\WINDOWS\system32\javacpl.cpl
2008-04-16 20:13 . 2008-04-16 20:21	<DIR>	d--------	C:\Program Files\SkanerOnline
2008-04-16 20:09 . 2008-04-20 08:00	1,024	--ah-----	C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG
2008-04-16 19:59 . 2008-04-16 19:59	<DIR>	d--------	C:\Program Files\Alwil Software
2008-04-16 19:59 . 2003-03-18 21:20	1,060,864	--a------	C:\WINDOWS\system32\MFC71.dll
2008-04-16 19:59 . 2003-03-18 20:14	499,712	--a------	C:\WINDOWS\system32\MSVCP71.dll
2008-04-16 19:59 . 2003-02-21 04:42	348,160	--a------	C:\WINDOWS\system32\MSVCR71.dll
2008-04-16 19:57 . 2008-04-16 20:21	<DIR>	d--------	C:\Program Files\Java
2008-04-16 19:55 . 2008-04-16 19:55	<DIR>	d--------	C:\Program Files\Common Files\Java
2008-04-16 19:48 . 2008-04-16 19:48	<DIR>	d--------	C:\WINDOWS\system32\Lang
2008-04-16 19:48 . 2008-04-16 19:48	940,794	--a------	C:\WINDOWS\system32\LoopyMusic.wav
2008-04-16 19:48 . 2008-04-16 19:48	146,650	--a------	C:\WINDOWS\system32\BuzzingBee.wav
2008-04-16 16:57 . 2008-04-16 16:57	<DIR>	d--------	C:\Documents and Settings\Pit\Dane aplikacji\Gadu-Gadu
2008-04-16 16:53 . 2008-04-16 16:53	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Last.fm
2008-04-16 16:52 . 2008-04-16 16:52	<DIR>	d--------	C:\Program Files\Last.fm
2008-04-16 16:30 . 2008-04-16 16:30	<DIR>	d--------	C:\Program Files\Trend Micro
2008-04-16 16:21 . 2008-04-16 16:21	<DIR>	d--------	C:\Program Files\foobar2000
2008-04-16 16:21 . 2008-04-19 13:54	<DIR>	d--------	C:\Documents and Settings\Pit\Dane aplikacji\foobar2000
2008-04-16 16:14 . 2008-04-16 16:14	<DIR>	d--------	C:\Program Files\Gadu-Gadu
2008-04-16 16:14 . 2008-04-16 19:49	<DIR>	d--------	C:\Documents and Settings\Pit\Gadu-Gadu
2008-04-16 16:12 . 2008-04-16 16:12	<DIR>	d---s----	C:\Documents and Settings\Pit\UserData
2008-04-16 16:06 . 2008-04-16 16:07	<DIR>	d--------	C:\WINDOWS\system32\RTCOM
2008-04-16 16:06 . 2008-04-16 16:06	<DIR>	d--------	C:\Program Files\Realtek
2008-04-16 16:06 . 2008-04-16 16:06	<DIR>	d--h-----	C:\Program Files\InstallShield Installation Information
2008-04-16 16:06 . 2008-04-16 16:06	<DIR>	d--------	C:\Documents and Settings\Pit\Dane aplikacji\InstallShield
2008-04-16 16:05 . 2004-11-18 10:42	22,752	--a------	C:\WINDOWS\system32\spupdsvc.exe
2008-04-16 16:05 . 2008-04-20 08:00	558	--a------	C:\WINDOWS\DFC.INI
2008-04-16 16:04 . 2008-04-16 16:04	<DIR>	d--------	C:\Program Files\Intel
2008-04-16 16:01 . 2008-04-16 16:01	<DIR>	d--------	C:\WINDOWS\nview
2008-04-16 16:01 . 2007-07-23 04:34	356,352	--a------	C:\WINDOWS\system32\nvudisp.exe
2008-04-16 16:01 . 2008-04-16 16:05	127,254	--a------	C:\WINDOWS\system32\nvapps.xml
2008-04-16 16:01 . 2007-07-23 04:34	17,463	--a------	C:\WINDOWS\system32\nvdisp.nvu
2008-04-16 16:01 . 2007-07-23 04:34	17,254	--a------	C:\WINDOWS\system32\nvwsapps.xml
2008-04-16 16:00 . 2008-04-16 16:00	<DIR>	d--------	C:\Program Files\Common Files\InstallShield

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-16 13:59	---------	d-----w	C:\Program Files\VDOTool
2008-04-16 13:51	---------	d-----w	C:\Program Files\microsoft frontpage
2008-04-16 13:50	---------	d-----w	C:\Program Files\Us³ugi online
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-06-26 14:58 2165272]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-07-23 04:34 8466432]
"nwiz"="nwiz.exe" [2007-07-23 04:34 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-07-23 04:34 81920]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 11:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360]

C:\Documents and Settings\Pit\Menu Start\Programy\Autostart\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-04-16 16:52:40 106496]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e196afd3-0bca-11dd-98df-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-20 08:00:46
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-20  8:00:58
ComboFix-quarantined-files.txt  2008-04-20 06:00:57

Pre-Run: 47,835,066,368 bajtów wolnych
Post-Run: 48,112,852,992 bajtów wolnych

114