瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 【求助】Backdoor.Gpigeon.iwBackdoor.Gpigeon.lb杀不完
繌GG - 2005-8-20 14:01:00
Backdoor.Gpigeon.iw
Backdoor.Gpigeon.lb


我用了瑞星杀了好多次，但重启电脑又出现了，杀都杀不完~~~~~`
高手们 8858 帮帮我吧！！！！！！


HijackThis_zww汉化版扫描日志 V1.99.1
保存于      13:51:04, 日期 2005-8-20
操作系统：  Windows XP  (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 (6.00.2600.0000)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\3721\assistse.exe
C:\Program Files\rising\Rfw\Rfw.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\Program Files\3721\Dlaccel\YDownloader.exe
C:\PROGRA~1\360so\360Main.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\3721\Dlaccel\TDUpdate.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Downloads\HJ\HijackThis1991zww.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v6.dll
O2 - BHO: Target Class - {002AF282-E42D-4B51-9F70-F1570C02FAAD} - C:\Program Files\NetMeting\Target\Target.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\Program Files\3721\Assist\Angling.dll
O2 - BHO: Deliverer Class - {3E290290-1728-4C1E-863A-AA12526333F6} - C:\Progra~1\CNet\ADDeliverer\0.9.9.5\ADDeliverer.dll
O2 - BHO: 360搜 - {472101C2-1109-43f4-9112-31F33E3F2127} - C:\Program Files\360so\360so.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Downloads\QQ聊天~`\QQIEHelper.dll
O2 - BHO: ReviseHelper Class - {749D1D7D-1969-4014-A98D-9E867E7508D0} - C:\Progra~1\8848\MySearch\0.9.8.4\PageRevisor.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\assist\asbar.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll
O2 - BHO: YiSou - {EF1D17A9-089F-40cc-8D64-7324CDEBA0DB} - C:\PROGRA~1\yisou\yisoub.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\assist\asbar.dll
O3 - IE工具栏增项: 一搜工具条 - {115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5} - C:\Program Files\yisou\yisou.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - 启动项HKLM\\Run: [assistse] "C:\PROGRA~1\3721\assistse.exe"
O4 - 启动项HKLM\\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - 启动项HKLM\\Run: [rfw] C:\Program Files\rising\Rfw\Rfw.exe
O4 - 启动项HKLM\\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - 启动项HKLM\\Run: [internat.exe] internat.exe
O4 - 启动项HKLM\\Run: [DTService] rundll32.exe C:\WINDOWS\system32\DTSERV~1.DLL,Load
O4 - 启动项HKLM\\Run: [dl_accel] C:\Program Files\3721\Dlaccel\YDownloader.exe
O4 - 启动项HKLM\\Run: [360Main.exe] C:\PROGRA~1\360so\360Main.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - IE右键菜单中的新增项目: !搜一搜 - res://C:\WINDOWS\DOWNLO~1\CnsMinEx.dll/1003
O8 - IE右键菜单中的新增项目: &使用下载加速专家下载 - C:\Program Files\3721\Dlaccel\geturl.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Downloads\QQ聊天~`\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Downloads\QQ聊天~`\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Downloads\QQ聊天~`\SendMMS.htm
O9 - 浏览器额外的按钮: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_taijilian_48651 (file missing)
O9 - 浏览器额外的按钮: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - 浏览器额外的按钮: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - 浏览器额外的按钮: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Downloads\QQ聊天~`\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Downloads\QQ聊天~`\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Downloads\QQ聊天~`\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Downloads\QQ聊天~`\QQIEHelper.dll
O9 - 浏览器额外的按钮: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - 浏览器额外的按钮: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - 浏览器额外的“工具”菜单项: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - 浏览器额外的按钮: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - 浏览器额外的“工具”菜单项: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  网络实名
O16 - DPF: {1F831FA1-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - http://pointa.autodesk.com/portal/lang/chs/InstFred.Ocx
O16 - DPF: {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} (BlueskyVideo Control) - http://www.bluesky.cn/download/v2_60.cab
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {58CDB34C-B4D7-418B-A0FB-C4C8A01C2F0E} - http://pi.51.net/download/diybar2.cab
O16 - DPF: {6F101641-AFFE-4E1F-9BF1-E8976A646549} (AlbumP Control) - http://album.tom.com/object/AlbumPProj1.ocx
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday 控件) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {86BC8440-8693-4076-A144-6BAF942B40B0} (RegMore Class) - http://mysearch.8848.com/mysearch/MySearch.CAB
O16 - DPF: {AE563722-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - http://pointa.autodesk.com/portal/lang/chs/InstBanr.Ocx
O16 - DPF: {BA0F088C-72C1-475A-92F8-42391DEF6961} (Blueskyvoice Control) - http://www.bluesky.cn/download/blueskyvoice_27.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview 控件) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C5C9FE1-6DD4-4018-9136-CACF57879691}: NameServer = 61.144.56.101
O23 - NT 服务: - - Unknown owner - C:\WINDOWS\winnt.exe
O23 - NT 服务: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - NT 服务: _Servers (Servers) - Unknown owner - C:\WINDOWS\$Server2.0.exe


一第下天 - 2005-8-20 14:08:00
同病相连，可是我都一个也杀不掉
麦子麦子 - 2005-8-20 14:22:00
我也是！
杀了2天了，重启后还是有
怎么办啊
小中 - 2005-8-20 14:34:00
Backdoor.Gpigeon.lb
所有进程都是Tvdpay_Hook.dll
瑞星清除失败
繌GG - 2005-8-20 14:40:00
要怎样做才能把毒给杀了？？？？？？
okbomb - 2005-8-20 14:56:00
正常。我卸载掉瑞星。装上kaspersky 5.0.372版本就解决了。
繌GG - 2005-8-20 16:29:00
还有其它方法吗？
冷雨夜阑 - 2005-8-20 16:35:00
O23 - NT 服务: _Servers (Servers) - Unknown owner - C:\WINDOWS\$Server2.0.exe 打包上传
Backdoor.Gpigeon.iw
Backdoor.Gpigeon.lb 2个普通的木马程序.清空缓存.关闭系统还原.到安全模式即可查杀
繌GG - 2005-8-20 16:47:00
5555555~`
菜鸟不明白~
命运里の金色 - 2005-8-20 16:57:00
O23 - NT 服务: - - Unknown owner - C:\WINDOWS\winnt.exe

O23 - NT 服务: _Servers (Servers) - Unknown owner - C:\WINDOWS\$Server2.0.exe
这两个都是灰鸽子的服务,具体参考http://forum.ikaka.com/topic.asp?board=28&artid=6202404

水冷斋 - 2005-8-20 17:07:00
病毒名称路径文件
Backdoor.Gpigeon.lbC:\WINDOWSWINNT_HOOK.DLL
Backdoor.Gpigeon.lbC:\WINDOWSWINNT_HOOK.DLL
Backdoor.Gpigeon.lbC:\WINDOWSWINNT_HOOK.DLL
Backdoor.Gpigeon.lbC:\WINDOWSWINNT_HOOK.DLL
Backdoor.Gpigeon.lbC:\WINDOWSWINNT_HOOK.DLL
Backdoor.Gpigeon.lbC:\WINDOWSWINNT_HOOK.DLL
Backdoor.Gpigeon.lbC:\WINDOWSWINNT_HOOK.DLL
Backdoor.Gpigeon.lbC:\WINDOWSWINNT_HOOK.DLL
Backdoor.Gpigeon.lbKERNEL32.DLL>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.iwMSGSRV32.EXE>>C:\WINDOWS\WINNTKEY.DLL
Backdoor.Gpigeon.iwMPREXE.EXE>>C:\WINDOWS\WINNTKEY.DLL
Backdoor.Gpigeon.lbMPREXE.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.iwMSTASK.EXE>>C:\WINDOWS\WINNTKEY.DLL
Backdoor.Gpigeon.lbMSTASK.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.iwCCENTER.EXE>>C:\WINDOWS\WINNTKEY.DLL
Backdoor.Gpigeon.lbCCENTER.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.iwRAVMOND.EXE>>C:\WINDOWS\WINNTKEY.DLL
Backdoor.Gpigeon.lbRAVMOND.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbRAVMON.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.iwRAVMON.EXE>>C:\WINDOWS\WINNTKEY.DLL
Backdoor.Gpigeon.iwmmtask.tsk>>C:\WINDOWS\WINNTKEY.DLL
Backdoor.Gpigeon.lbEXPLORER.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.iwEXPLORER.EXE>>C:\WINDOWS\WINNTKEY.DLL
Backdoor.Gpigeon.lbRUNDLL32.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbTASKMON.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbSYSTRAY.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbSOUNDMAN.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbINTERNAT.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbWMIEXE.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbMPREXE.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbMSTASK.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbCCENTER.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbRAVMOND.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbRAVMON.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.lbEXPLORER.EXE>>C:\WINDOWS\WINNT_HOOK.DLL
Backdoor.Gpigeon.iwEXPLORER.EXE>>C:\WINDOWS\WINNTKEY.DLL


偶是菜鸟，想问问我这个怎么办啊~
水冷斋 - 2005-8-20 17:19:00
Logfile of HijackThis v1.99.1
Scan saved at 17:12:31, on 05-8-20
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAM FILES\RISING\RAV\RAVTIMER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX00.762\HIJACKTHIS.EXE

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRAM FILES\3721\ASSIST\ANGLING.DLL
O2 - BHO: Router Layer - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINDOWS\SYSTEM32\ACLAYER.DLL (file missing)
O2 - BHO: YiSou - {EF1D17A9-089F-40cc-8D64-7324CDEBA0DB} - C:\PROGRA~1\YISOU\YISOUB.DLL
O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL
O3 - Toolbar: 一搜工具条 - {115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5} - C:\PROGRAM FILES\YISOU\YISOU.DLL
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] rem Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [IgfxTray] rem C:\WINDOWS\SYSTEM\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] rem C:\WINDOWS\SYSTEM\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [helper.dll] rem C:\WINDOWS\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [CnsMin] rem Rundll32.exe C:\WINDOWS\DOWNLO~1\CNSMIN.DLL,Rundll32
O4 - HKLM\..\Run: [LoadQM] rem loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] rem "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [RsCcenter] C:\PROGRA~1\RISING\RAV\CCENTER.EXE
O4 - HKLM\..\RunServices: [RavMond] C:\PROGRA~1\RISING\RAV\RAVMOND.EXE
O4 - HKLM\..\RunServices: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [winnt.exe] C:\WINDOWS\winnt.exe
O8 - Extra context menu item: 添加到QQ表情 - E:\OICQ\AddEmotion.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\OICQ\AddPanel.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\OICQ\SendMMS.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\PROGRAM FILES\FLASHGET\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\PROGRAM FILES\FLASHGET\jc_all.htm
O8 - Extra context menu item: !搜一搜 - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\CnsMinEx.dll/1003
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\oicq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\oicq\QQ.EXE
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://C:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D0A29C6C-AA71-4423-8C4A-5998B774C448} (IEDown Class) - http://download.ourgame.com/IEDown4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab

你好！HELLO - 2005-8-20 17:41:00
【回复“繌GG”的帖子】
是灰鸽子吗?是的话,中毒者报的病毒文件列表中还应该有WINNT.EXE和WINNT.DLL呀!
命运里の金色 - 2005-8-20 17:54:00
【回复“水冷斋”的帖子】
开始-运行输入regedit,编辑-查找,在注册表里查找到C:\WINDOWS\WINNT.exe所在的项把他删除
在重起后,找到C:\WINDOWS\WINNT.exe,C:\WINDOWS\WINNT.dll,C:\WINDOWS\WINNT_HOOK.dll,C:\WINDOWS\WINNTKEY.dll能找到的都删除
繌GG - 2005-8-20 17:57:00
3Q!~~~~~~``
我终于把毒杀了！
1
查看完整版本: 【求助】Backdoor.Gpigeon.iwBackdoor.Gpigeon.lb杀不完
© 2000 - 2026 Rising Corp. Ltd.