Problem z hacked-by-godzilla czegos nie wiem plz pomocy

[syberius]

elo mam problem z godzilla

znalazłem poradnik jak to zwalczyć

Kod: Zaznacz wszystko

http://forum.programosy.pl/hacked-by-godzilla-log-vp621466.html-sid=e03ed96c29fd57fe22593040e50a3bd3#p621466

start >> uruchom >> gpedit.msc >> konfiguracja uzytkownika >> szablony administracyjne >> podwojnie klikasz na Turn Off

doszłem do tego momentu



i co dalej? ni widze tego turn off..;/

[alamakota]

Witaj,
zastosuj tak jak wszyscy:


http://www.programosy.pl/program,combofix.html
(wklej log na forum)
oraz
http://downloads.andymanchesta.com/Remo ... /SDFix.exe
(uruchamiasz plik RunThis.cmd)

[syberius]

log z comb fixa

Kod: Zaznacz wszystko

ComboFix 08-09-04.09 - Ryszard 2008-09-05 20:40:03.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.203 [GMT 2:00]
Running from: C:\Documents and Settings\Ryszard\Pulpit\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
C:\WINDOWS\MS32DLL.dll.vbs

.
(((((((((((((((((((((((((   Files Created from 2008-08-05 to 2008-09-05  )))))))))))))))))))))))))))))))
.

2008-09-05 19:29 . 2008-09-05 19:29   <DIR>   d--------   C:\Documents and Settings\Ryszard\Dane aplikacji\Gadu-Gadu
2008-09-05 19:24 . 2003-12-17 12:10   110,592   --a------   C:\WINDOWS\system32\AegisI5.exe
2008-09-05 19:24 . 2003-09-03 10:12   86,016   --a------   C:\WINDOWS\system32\install.dll
2008-09-05 19:24 . 2004-04-22 10:57   62,848   --a------   C:\WINDOWS\system32\drivers\RT2400.sys
2008-09-05 19:24 . 2003-05-21 10:17   45,056   --a------   C:\WINDOWS\system32\DEDriverDLL.dll
2008-09-05 19:24 . 2002-05-24 09:44   36,864   --a------   C:\WINDOWS\system32\WRLSetup.exe
2008-09-05 19:24 . 2003-06-24 11:22   32,768   --a------   C:\WINDOWS\system32\SmartInstallCfg2.dll
2008-09-05 19:24 . 2003-08-29 15:55   28,672   --a------   C:\WINDOWS\system32\CCS24.exe
2008-09-05 19:24 . 2008-09-05 19:24   15,781   --a------   C:\WINDOWS\system32\drivers\mdc8021x.sys
2008-09-05 19:23 . 2008-09-05 19:23   <DIR>   d--------   C:\Program Files\RALINK
2008-09-05 19:23 . 2008-09-05 19:23   <DIR>   d--h-----   C:\Program Files\InstallShield Installation Information
2008-09-05 19:23 . 2008-09-05 19:23   <DIR>   d--------   C:\Program Files\Common Files\InstallShield
2008-09-05 19:12 . 2008-09-05 19:12   <DIR>   d--------   C:\Program Files\eMule
2008-09-05 19:11 . 2008-09-05 19:11   <DIR>   d--------   C:\Program Files\Winamp
2008-09-05 19:10 . 2008-09-05 19:10   <DIR>   d--------   C:\Program Files\XVid;-)
2008-09-05 19:09 . 2008-09-05 19:09   <DIR>   d--------   C:\Program Files\ffdshow
2008-09-05 19:09 . 2006-12-10 23:32   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
2008-09-05 19:09 . 2006-12-10 23:32   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
2008-09-05 19:09 . 2007-04-24 17:30   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-09-05 19:09 . 2007-05-08 20:23   10,752   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-09-05 19:09 . 2006-12-10 23:32   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-09-05 19:08 . 2008-09-05 19:08   <DIR>   d--------   C:\Program Files\DirectX
2008-09-05 19:06 . 2008-09-05 19:06   <DIR>   d--------   C:\Documents and Settings\Ryszard\Dane aplikacji\Ahead
2008-09-05 19:05 . 2008-09-05 19:05   <DIR>   d--------   C:\Program Files\Nero
2008-09-05 19:05 . 2008-09-05 19:07   <DIR>   d--------   C:\Program Files\Common Files\Ahead
2008-09-05 19:00 . 2008-09-05 19:00   0   --a------   C:\WINDOWS\nsreg.dat

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-05 18:37   3,754   --sha-r   C:\MS32DLL.dll.vbs
2008-09-05 16:59   ---------   d-----w   C:\Program Files\Gadu-Gadu
2008-09-05 16:58   ---------   d-----w   C:\Program Files\SubEdit-Player
2008-09-05 16:49   ---------   d-----w   C:\Program Files\microsoft frontpage
2008-09-05 16:46   ---------   d-----w   C:\Program Files\Usługi online
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-08-22 94208]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-25 2101248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 159744]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Raconfig.lnk - C:\Program Files\RALINK\RT2400 Wireless LAN Card\Installer\WINXP\RaConfig.exe [2008-09-05 479232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-04-25 17:27 2101248 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-05-15 00:22 35328 C:\Program Files\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=

R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys [2004-04-22 62848]

*Newly Created Service* - PROCEXP90
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Ryszard\Dane aplikacji\Mozilla\Firefox\Profiles\31bxlla0.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.pl
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-05 20:41:09
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-05 20:42:18
ComboFix-quarantined-files.txt  2008-09-05 18:42:16

Pre-Run: 19,708,391,424 bajtów wolnych
Post-Run: 20,322,320,384 bajtów wolnych

95

co jest nie tak?;/