Logi - Czy to są wirusy ?

Witam wszystkich!

Mam problem, mianowicie gdy tylko chcę otworzyc jakąś aplikację, uruchamia się na senkundę proces IE, po czym znika. Dalej nic się nie dzieje. Tutaj log z HJT, ComboFix'a nie udało mi się uruchomić:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:40:14, on 2008-06-30
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu 7\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-1123561945-789336058-1060284298-1003\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu 7\gg.exe" /tray (User '?')
O4 - HKUS\S-1-5-21-1123561945-789336058-1060284298-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background (User '?')
O4 - HKUS\S-1-5-21-1123561945-789336058-1060284298-1003\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206280263925
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\System32\UAService7.exe

--
End of file - 3953 bytes

Jak dla mnie logi wyglądaja na czyste, ale zabardzo się na tym nie znam... Może to nie wirusy? Ma ktoś jakis pomysł jak to rozwiazac?
Z góry dziękuję i pozdrawiam

Log czysty daj może loga z combofixa

Log c ComboFix'a:

ComboFix 08-06-20.4 - AMD 800 2008-06-30 21:24:01.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional  5.1.2600.1.1250.1.1045.18.265 [GMT 2:00]
Running from: C:\Documents and Settings\AMD 800\Pulpit\G R Y   MICHAŁA\ComboFix.exe
 * Created a new restore point
 * Resident AV is active


[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-05-28 to 2008-06-30  )))))))))))))))))))))))))))))))
.

2008-06-30 14:10 . 2008-06-30 14:10	<DIR>	d--------	C:\Program Files\Trend Micro
2008-06-30 14:09 . 2008-06-30 14:09	<DIR>	d--------	C:\Program Files\Lavalys
2008-06-30 09:16 . 2008-06-30 09:16	<DIR>	d--hs----	C:\FOUND.011
2008-06-28 13:16 . 2001-08-17 22:03	24,192	--a------	C:\WINDOWS\system32\drivers\usbser.sys
2008-06-28 13:16 . 2001-08-17 22:03	24,192	--a------	C:\WINDOWS\system32\dllcache\usbser.sys
2008-06-27 18:06 . 2008-06-27 18:07	0	--ah-----	C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-06-27 18:06 . 2008-06-27 18:07	0	--ah-----	C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-06-27 15:20 . 2008-06-27 15:20	<DIR>	d--------	C:\WINDOWS\system32\DRVSTORE
2008-06-27 15:20 . 2008-06-27 15:20	<DIR>	d--------	C:\Program Files\PC Connectivity Solution
2008-06-27 15:20 . 2008-06-27 15:20	<DIR>	d--------	C:\Program Files\DIFX
2008-06-27 15:20 . 2007-11-29 10:33	1,419,232	--a------	C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-06-27 15:20 . 2007-11-29 10:39	95,744	--a------	C:\WINDOWS\system32\nmwcdcocls.dll
2008-06-27 15:20 . 2007-11-29 10:32	48,128	--a------	C:\WINDOWS\system32\nmwcdcls.dll
2008-06-27 15:20 . 2007-09-17 15:53	21,632	--a------	C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-06-27 15:20 . 2007-11-29 10:39	16,896	--a------	C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-06-27 15:20 . 2007-11-29 10:39	8,064	--a------	C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-06-27 15:19 . 2008-06-27 15:19	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-06-26 16:49 . 2008-06-26 16:50	<DIR>	d--------	C:\Program Files\7-Zip
2008-06-25 23:12 . 2008-06-25 23:12	<DIR>	d--------	C:\Program Files\Wesnoth 1.4

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-23 12:21	691,545	----a-w	C:\WINDOWS\unins000.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="D:\Program Files\Gadu-Gadu 7\gg.exe" [2005-09-15 15:43 1712128]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-07-28 21:19 4841472]
"nwiz"="nwiz.exe" [2003-07-28 21:19 323584 C:\WINDOWS\system32\nwiz.exe]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2006-02-28 15:34 921600]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 16:05 13312]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
RaConfig.lnk - C:\WINDOWS\system32\RaConfig.exe [2006-11-06 13:38:57 380928]

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]
"NoAutoUpdate"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
Z:\Program Files\TLEN\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-11-15 16:18 1670144 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
Z:\Program Files\Skype\Phone\Skype.exe

R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\System32\DRIVERS\RT2400.sys [2003-10-08 13:14]
S3 WLPCIV27;IEEE802.11b WLAN PCI Card v3.0 Driver;C:\WINDOWS\System32\DRIVERS\WLPCIV27.sys [2002-07-30 10:22]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-06-26 13:50:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-30 21:29:25
Windows 5.1.2600 Dodatek Service Pack. 1 FAT NTAPI

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-06-30 21:30:16
ComboFix-quarantined-files.txt  2008-06-30 19:30:16

Pre-Run: 1,646,481,408 bajtów wolnych
Post-Run: 1,645,854,720 bajtów wolnych

91

Wklej do notatnika

Folder::
C:\FOUND.011

>>Plik>>Zapisz jako... >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe)
– podobnie jak na tym obrazku -->
(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)
Po restarcie usuń ręcznie folder C: \Qoobox.

Niestety, po przeciągnięciu CFScript.txt na CFix'a, odpala na chwilę proces IE po czym się wyłącza. Próbowałem robic to zarówno normalnie jak i w trybie awaryjnym, cały czas to samo. Dalej nic się nie dzieje.

A pokaż teraz loga z combofixa.

Teraz po odpaleniu CF pokazuje mi coś takiego:

po czym CF się samoistnie kasuje.