瑞星卡卡安全论坛

病毒名 病毒别名
1.  2    Backdoor.GPigeon      灰鸽子病毒
2.  2    Backdoor.GPigeon.3.a     
3.  2    Backdoor.GPigeon.3.b     
4.  2    Backdoor.GPigeon.3.c     
5.  2    Backdoor.GPigeon.3.d      灰鸽子
6.  2    Backdoor.GPigeon.3.e      灰鸽子
7.  2    Backdoor.Gpigeon.3.f     
8.  2    Backdoor.Gpigeon.3.g     
9.  2    Backdoor.Gpigeon.3.h     
10.  2    Backdoor.GPigeon.4.a      灰鸽子后门
11.  2    Backdoor.Gpigeon.4.ag     
12.  2    Backdoor.GPigeon.4.ah     
13.  2    Backdoor.Gpigeon.4.ai     
14.  2    Backdoor.Gpigeon.4.aj     
15.  2    Backdoor.Gpigeon.4.ak     
16.  2    Backdoor.GPigeon.4.b      灰鸽子
17.  2    Backdoor.GPigeon.4.c     
18.  2    Backdoor.GPigeon.4.d     
19.  2    Backdoor.GPigeon.4.e     
20.  2    Backdoor.GPigeon.4.f     
  这个病毒我为什么怎么杀都杀不掉啊谁能告诉我啊手动的太复杂不会搞,系统从装了以后还是有这个

55555555555r

Logfile of HijackThis v1.99.1
Scan saved at 3:12:04, on 2005-8-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
D:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\Program Files\3721\Dlaccel\YDownloader.exe
C:\WINDOWS\system32\winlogin.pif
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
D:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\System32\alg.exe
D:\QQ聊天工具\QQ.exe
C:\WINDOWS\System32\svchost.exe
D:\QQ聊天工具\TIMPlatform.exe
D:\QQ聊天工具\QQMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\conime.exe
C:\DOCUME~1\new\LOCALS~1\Temp\Rar$EX00.891\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v6.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\QQ聊天工具\QQIEHelper.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O4 - HKLM\..\Run: [RavTimer] D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] D:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [dl_accel] C:\Program Files\3721\Dlaccel\YDownloader.exe
O4 - HKLM\..\Run: [Windows Login Security] winlogin.pif
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\RunServices: [Windows Login Security] winlogin.pif
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Windows Login Security] winlogin.pif
O4 - HKCU\..\RunServices: [Windows Login Security] winlogin.pif
O8 - Extra context menu item: &使用下载加速专家下载 - C:\Program Files\3721\Dlaccel\geturl.htm
O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ聊天工具\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\QQ聊天工具\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ聊天工具\SendMMS.htm
O9 - Extra button: 微软 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.microsoft.com/china/index.htm (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ聊天工具\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ聊天工具\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ聊天工具\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ聊天工具\QQIEHelper.dll

http://forum.ikaka.com/topic.asp?board=28&artid=6979213这个帖子10楼,要手工杀毒我可以教,随你

太可怕了

手工太复杂了我不会啊

【回复“fddfdfdfdfd”的帖子扫描日志不全!
用附件里的再扫一次再传上来!!!


附件: 5598202005816131156.rar

Logfile of HijackThis v1.99.1
Scan saved at 13:15:24, on 2005-8-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
D:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\WINDOWS\system32\svchost.exe
D:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\System32\svchost.exe
D:\QQ聊天工具\QQ.exe
D:\QQ聊天工具\TIMPlatform.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\winlogin.pif
D:\QQ聊天工具\QQMail.exe
D:\QQ聊天工具\QQexternal.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\conime.exe
D:\Program Files\rising\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v6.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\QQ聊天工具\QQIEHelper.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O4 - HKLM\..\Run: [RavTimer] D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] D:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [dl_accel] C:\Program Files\3721\Dlaccel\YDownloader.exe
O4 - HKLM\..\Run: [Windows Login Security] winlogin.pif
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\RunServices: [Windows Login Security] winlogin.pif
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Windows Login Security] winlogin.pif
O4 - HKCU\..\RunServices: [Windows Login Security] winlogin.pif
O8 - Extra context menu item: &使用下载加速专家下载 - C:\Program Files\3721\Dlaccel\geturl.htm
O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ聊天工具\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\QQ聊天工具\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ聊天工具\SendMMS.htm
O9 - Extra button: 微软 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.microsoft.com/china/index.htm (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ聊天工具\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ聊天工具\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ聊天工具\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ聊天工具\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CFF47B2-468C-4C41-A091-E7ED1050664B}: NameServer = 202.96.209.6 202.96.209.133
O17 - HKLM\System\CS1\Services\Tcpip\..\{0CFF47B2-468C-4C41-A091-E7ED1050664B}: NameServer = 202.96.209.6 202.96.209.133
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: kokQQ:61544086 - Unknown owner - C:\WINDOWS\kok.exe (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe

O23 - Service: kokQQ:61544086 - Unknown owner - C:\WINDOWS\kok.exe (file missing)
问题项!

O23 - Service: kokQQ:61544086 - Unknown owner - C:\WINDOWS\kok.exe (file missing)
主文件你已经干掉了嘛，修复它。

就你的日志而言，
终止进程：
C:\WINDOWS\system32\winlogin.pif

修复：
O4 - HKLM\..\Run: [Windows Login Security] winlogin.pif
O4 - HKCU\..\Run: [Windows Login Security] winlogin.pif
O4 - HKCU\..\RunServices: [Windows Login Security] winlogin.pif

然后在安全模式下删除C:\WINDOWS\system32\winlogin.pif

赶快去给系统把关键更新全部打上。

补丁哪有下

大哥我急啊２天花了我几百块还没修好５５５５５５５５５５补丁在哪下啊

人都跑什么地方去啦

人呢５５５５５５５５５５５

要被人给顶下去了晕

【回复“fddfdfdfdfd”的帖子】

补丁就在    开始-所有程序-windows update  里

谢谢