Witam serdecznie.
Czy ktos jest w stanie mi powiedziec jak usunac tego rootkita?

Problem dotyczy pliku c:/windows/system32/docent0.dll
Jak probuje usunac w trybie awaryjnym wiersz 20, w ktorym pojawia sie w/w plik, to ponowny skan dalej pokazuje jego obecnosc.
Jak sobie z tym poradzic? Wylaczylem przywracanie w kluczu localmachine/software/microsoft/windowsnt/systemrestore/disableSR 1

Wklejam log z HiJacka:

Logfile of HijackThis v1.99.1
Scan saved at 21:21:34, on 2006–02–23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
D:\Shareaza\Shareaza.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
D:\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AntiVir PersonalEdition Classic\avscan.exe
C:\Documents and Settings\Monika\Pulpit\HijackThis.exe

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
O2 – BHO: Yahoo! Toolbar Helper – {02478D38–C3F9–4EFB–9B51–7695ECA05670} – C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 – BHO: Shareaza Web Download Hook – {0EEDB912–C5FA–486F–8334–57288578C627} – D:\Shareaza\Plugins\RazaWebHook.dll
O2 – BHO: SSVHelper Class – {761497BB–D6F0–462C–B6EB–D4DAF1D92D43} – C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 – Toolbar: Yahoo! Toolbar – {EF99BD32–C1FB–11D2–892F–0090271D4F88} – C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 – HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 – HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 – HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 – HKLM\..\Run: [gcasServ] "D:\Microsoft AntiSpyware\gcasServ.exe"
O4 – HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" –atboottime
O4 – HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 – HKCU\..\Run: [Shareaza] "D:\Shareaza\Shareaza.exe" –tray
O8 – Extra context menu item: Download with &Shareaza – res://D:\Shareaza\Plugins\RazaWebHook.dll/3000
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 – Extra button: Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O16 – DPF: {DF780F87–FF2B–4DF8–92D0–73DB16A1543A} (PopCapLoader Object) – http://www.popcap.com/games/popcaploader_v6.cab
O17 – HKLM\System\CCS\Services\Tcpip\..\{83C1F0A3–B28B–4CB4–BC36–6573917DD7DC}: NameServer = 217.30.129.149,217.30.137.200
O20 – Winlogon Notify: docent0 – C:\WINDOWS\SYSTEM32\docent0.dll
O23 – Service: AntiVir Scheduler (AntiVirScheduler) – H+BEDV Datentechnik GmbH – C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 – Service: AntiVir PersonalEdition Classic Service (AntiVirService) – H+BEDV Datentechnik GmbH – C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 – Service: InstallDriver Table Manager (IDriverT) – Macrovision Corporation – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:\WINDOWS\System32\nvsvc32.exe