czy mam keyloggera?

[stevenloop]

Czy możecie sprawdzic na podstawie tych logow czy mam keyloggera? : |

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:03:38, on 2008-05-22
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [BearShare] "E:\bs\BearShare.exe" /pause
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--
End of file - 3971 bytes

Jutro dam loga z Silent Runners jakby co

[Magik]

Witam

Kod: Zaznacz wszystko

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

praktycznie wzorowy log.......

[stevenloop]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:29:56, on 2008-05-22
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
E:\bs\BearShare.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [BearShare] "E:\bs\BearShare.exe" /pause
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--
End of file - 4018 bytes

dziekuje a moze ktos sprawdzic tego loga jeszcze mi sie wydaje ze to taki sam albo podobny nie wiem czy cos sie zmnienilo ale niech ktos sprawdzi prosze to jau ostatni nie bede wam juz czasu zajmowal

[Okocza]

daj jeszcze log z Combofixa bo to że Hijack jest czysty nie znaczy że w komputerze nie ma pozostałości po tym co było.

[stevenloop]

ComboFix:

ComboFix 08-05-21.2 - Mazi 2008-05-22 18:22:42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.223 [GMT 2:00]
Running from: C:\Documents and Settings\\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\myglobalsearch\bar\Cache\00726FE6.bin
C:\Program Files\myglobalsearch\bar\Cache\00727331.bin
C:\Program Files\myglobalsearch\bar\Cache\007274F6.bin
C:\Program Files\myglobalsearch\bar\Cache\01D775B9
C:\Program Files\myglobalsearch\bar\Cache\files.ini
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm
C:\Program Files\myglobalsearch\bar\Settings\settings.dat
C:\Program Files\myglobalsearch\bar\Settings\settings.dat.bak
C:\Program Files\myglobalsearch\bar\Settings\settings.htm
C:\Program Files\myglobalsearch\bar\Settings\settings.htm.bak

.
((((((((((((((((((((((((( Files Created from 2008-04-22 to 2008-05-22 )))))))))))))))))))))))))))))))
.

2008-05-22 01:59 . 2008-05-22 01:59 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-16 23:13 . 2008-05-17 11:51 <DIR> d-------- C:\Program Files\CamStudio
2008-05-16 23:12 . 2008-05-17 16:43 <DIR> d-------- C:\Program Files\fraps
2008-05-15 18:04 . 2008-05-15 18:04 <DIR> d-------- C:\Program Files\Tlen.pl
2008-05-11 19:22 . 2008-05-11 19:22 <DIR> d-------- C:\Program Files\MTA San Andreas
2008-05-10 16:01 . 2008-05-16 22:35 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-09 18:50 . 2008-05-09 18:50 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-05-08 18:08 . 2008-05-08 18:08 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-05-08 18:08 . 2008-05-08 18:08 <DIR> d-------- C:\Documents and Settings\\SystemRequirementsLab
2008-05-02 14:02 . 2008-05-10 17:44 33 --a------ C:\WINDOWS\GunzLauncher.INI
2008-05-02 14:00 . 2008-05-02 14:00 <DIR> d-------- C:\ijji
2008-05-02 14:00 . 2008-05-02 17:36 <DIR> d--h----- C:\Documents and Settings\\Dane aplikacji\ijjigame
2008-05-02 13:46 . 2008-05-02 13:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\IJJIGame
2008-04-30 14:02 . 2008-04-30 14:02 <DIR> d-------- C:\Program Files\BearShare Applications
2008-04-30 14:02 . 2008-05-21 15:14 <DIR> d-------- C:\Documents and Settings\\Dane aplikacji\BearShare
2008-04-30 14:02 . 2007-11-22 17:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-21 15:47 --------- d-----w C:\Documents and Settings\Mazi\Dane aplikacji\uTorrent
2008-05-21 13:14 --------- d-----w C:\Program Files\BearShare
2008-05-19 17:06 --------- d-----w C:\Documents and Settings\Mazi\Dane aplikacji\Tlen.pl
2008-05-15 16:07 --------- d-----w C:\Program Files\Gadu-Gadu
2008-05-09 16:05 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 15:11 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-11 20:42 --------- d-----w C:\Program Files\Common Files\INCA Shared
2008-04-08 13:45 --------- d-----w C:\Program Files\GRETECH
2008-04-08 13:45 --------- d-----w C:\Documents and Settings\\Dane aplikacji\GRETECH
2008-04-08 13:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\GRETECH
2008-04-07 15:56 --------- d-----w C:\Documents and Settings\\Dane aplikacji\AccurateRip
2008-04-07 15:55 --------- d-----w C:\Program Files\Illustrate
2008-03-31 17:04 --------- d-----w C:\Program Files\Lavalys
2008-03-31 15:34 --------- d-----w C:\Program Files\NiemPol
2008-03-30 12:27 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-30 01:07 --------- d-----w C:\Program Files\D-Tools
2008-03-30 00:53 --------- d-----w C:\Program Files\SubEdit-Player
2008-03-29 19:09 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.36-8876480L.exe
2008-03-29 19:09 --------- d-----w C:\Program Files\Logitech
2008-03-29 19:05 --------- d-----w C:\Program Files\MUSICMATCH
2008-03-29 19:02 --------- d-----w C:\Program Files\Common Files\Logitech
2008-03-29 18:54 --------- d-----w C:\Program Files\Common Files\Nero
2008-03-29 18:50 --------- d-----w C:\Program Files\Ahead
2008-03-29 18:47 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-29 18:37 --------- d-----w C:\Program Files\ESET
2008-03-29 14:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-03-29 14:13 --------- d-----w C:\Program Files\uTorrent
2008-03-29 14:13 --------- d-----w C:\Program Files\CCleaner
2008-03-29 14:07 --------- d-----w C:\Documents and Settings\Mazi\Dane aplikacji\Gadu-Gadu
2008-03-29 13:59 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-03-29 13:50 --------- d-----w C:\Program Files\GameSpy Arcade
2008-03-29 13:30 --------- d-----w C:\Program Files\Java
2008-03-29 13:26 --------- d-----w C:\Program Files\Common Files\Java
2008-03-29 10:53 --------- d-----w C:\Program Files\SAGEM WiFi manager
2008-03-29 10:53 --------- d-----w C:\Program Files\SAGEM
2008-03-29 10:53 --------- d-----w C:\Documents and Settings\\Dane aplikacji\InstallShield
2008-03-29 10:46 --------- d-----w C:\Program Files\Realtek Sound Manager
2008-03-29 10:46 --------- d-----w C:\Program Files\AvRack
2008-03-29 10:45 --------- d-----w C:\Program Files\Gigabyte
2008-03-29 10:35 --------- d-----w C:\Program Files\microsoft frontpage
2008-03-29 10:34 558,142 ----a-w C:\WINDOWS\java\Packages\ZHR3VV1N.ZIP
2008-03-29 10:34 155,995 ----a-w C:\WINDOWS\java\Packages\FBT3HZXN.ZIP
2008-03-29 10:33 --------- d-----w C:\Program Files\Usługi online
.

------- Sigcheck -------

2004-08-04 08:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\SoftwareDistribution\Download\6365088f85b501588ee599470d0e71a8\ip6fw.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-11-15 16:18 1670144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 12:06 1443072]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-05-24 10:50 28672]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-05-29 02:59 520192]
"BearShare"="E:\bs\BearShare.exe" [2006-08-01 17:04 3313664]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-29 00:00 13312]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-03-29 21:09:19 169472]
Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2008-03-29 12:53:19 950272]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
--a------ 2008-04-17 11:42 8066488 C:\Program Files\BearShare\BearShare.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 C:\Program Files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2003-08-15 09:34 57344 C:\WINDOWS\SOUNDMAN.EXE

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\System32\drivers\sfdrv01a.sys [2006-07-05 14:46]
R1 epfwtdir;epfwtdir;C:\WINDOWS\System32\DRIVERS\epfwtdir.sys [2008-02-20 12:11]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\System32\DRIVERS\WlanBZXP.sys [2007-01-10 11:14]
S3 GameGuardDown;GameGuard Down;C:\DOCUME~1\Mazi\USTAWI~1\Temp\GGD.sys []
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2002-08-29 01:32]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\System32\ZDCndis5.SYS []

*Newly Created Service* - ALG
*Newly Created Service* - IPNAT
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-22 18:25:25
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
.
**************************************************************************
.
Completion time: 2008-05-22 18:27:23 - machine was rebooted []
ComboFix-quarantined-files.txt 2008-05-22 16:27:20

Pre-Run: 5,972,873,216 bajtów wolnych
Post-Run: 6,928,297,984 bajt˘w wolnych

158 --- E O F --- 2008-05-05 11:59:31

[Magik]

Combo usuanale pare rzeczy, ja osobiscie nie widze juz nic podejrzanego

Pozdro