瑞星卡卡安全论坛

我中了Backdoor.Gpigeon.5.cd试过很多方法都无效
  我装的是瑞星2005正版杀毒软件和瑞星防火墙2005正版.XP SP2系统
  每次启动完毕后,瑞星防火墙总是提示你中了木马,IEXPLORE.EXE>>C:\Program File\Internet Explorer\IEXPLORE.EXE->Backdoor.Gpigeon.5.cd 已成功删除.但是每次启动都有,怎么杀都无效,我试过"木马清除大师","木马克星",木马专杀工具",灰鸽子检查器"等进行检查并未发现,用瑞星全面查杀也未发现.
  还有一个重大问题:该病毒还阻止了我的瑞星正常智能升级,我可是花198大洋买的正版呀!救救我吧!!!!

【回复“chinayang”的帖子】
请参考http://forum.ikaka.com/topic.asp?board=28&artid=6202404

我是菜鸟,能不能讲简单点?
正在试!!!

Logfile of HijackThis v1.99.1
Scan saved at 21:47:08, on 2005-9-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5112.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
D:\RISING\CCENTER.EXE
D:\RISING\Ravmond.exe
C:\Program Files\Rising\Rfw\RfwMain.exe
D:\RISING\RAVTIMER.EXE
D:\RISING\RAVMON.EXE
D:\SSM防木马软件\System Safety Monitor\HA_SSM196b2_CZ.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\内存清道夫\RamCleaner\RamCleaner.exe
D:\RISING\RavStub.exe
D:\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\QQ\QQIEHelper.dll
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\BaiduBar.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\BaiduBar.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RavTimer] D:\RISING\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] D:\RISING\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RamCleaner] D:\内存清道夫\RamCleaner\RamCleaner.exe
O8 - Extra context menu item: &使用迅雷下载 - D:\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\Thunder\getAllurl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ\SendMMS.htm
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE
O9 - Extra button: 易趣购物 - {DE607142-AC19-422e-864A-4D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607142-AC19-422e-864A-4D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ\QQIEHelper.dll
O9 - Extra button: 清理 - {FC5F1910-F130-11DB-BB90-00C04F79FFC0} - D:\完美卸载V2006\TrackClean.exe (file missing)
O9 - Extra 'Tools' menuitem: 完美卸载嵌入IE清理 - {FC5F1910-F130-11DB-BB90-00C04F79FFC0} - D:\完美卸载V2006\TrackClean.exe (file missing)

O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124943822000
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - C:\Program Files\Rising\Rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RISING\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RISING\Ravmond.exe
O23 - Service: System Safety Monitor (SSM) - Unknown owner - D:\SSM防木马软件\System Safety Monitor\HA_SSM196b2_CZ.EXE (file missing)
O23 - Service: System_Server - Unknown owner - C:\WINDOWS\System_Server.exe

我扫描的日志,请各位高手帮忙!指点一下,小弟在此谢了

【回复“chinayang”的帖子】

O23 - Service: System_Server - Unknown owner - C:\WINDOWS\System_Server.exe

灰鸽子

C:\WINDOWS\System_Server.exe
就是这！

谢谢各位高手!怎么才能彻底删除呀?

我全打开所有隐藏显示,包括全部显示系统文件,都没有看到呀?

谢谢了,今天有事,今晚我才上线,请各位大侠帮忙

好像瑞星的使用者总是中这玩意，金山和kv的论坛提这个的相对少很多，瑞星怎么回事？

是呀,我看论坛中这种病毒的太多了,很不好查杀的.

多谢指教,我已按照上面的方法http://forum.ikaka.com/topic.asp?board=28&artid=6202404  清除掉了,多谢