中了backdoor.Gpigeon.kc，除了RFW，其他的杀毒软件都检测不到，下了灰鸽子专杀工具也查不到。 每次都是开机RFW清除干净，下次开机又出来。
试过了 手动清除的方法，除了一个mag_hook.dll,根本找不到其他_hook.dll文件，更不用说 相对应的.exe和.dll文件。

请高手指点！

先把注册表里的服务删除,然后重起在删除文件,不知道你是怎么杀的?

可是根本不知道删除注册表里的哪个服务啊......

把你的hijackthis的log贴上来看看

Logfile of HijackThis v1.99.1
Scan saved at 14:36:34, on 2005/09/10
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\RAV\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
D:\RAV\CCENTER.EXE
C:\WINDOWS\Explorer.EXE
D:\RAV\RAVTIMER.EXE
D:\RAV\RAVMON.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wdfmgr.exe
D:\Adobe\Distillr\acrotray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Rav\Rfw\rfwmain.exe
d:\rav\rfw\rfwsrv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
D:\Tencent\MyIM\MyIM.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\WINDOWS\System32\mdm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\VSS\win32\SSEXP.EXE
C:\BFORTH\SALES\App\bfsales.exe
C:\BFORTH\DLL\dbeng9.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
D:\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Adobe\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - d:\NetTransport\NTIEHelper.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll
O3 - Toolbar: ラジオ(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ﾍ・ﾀﾍ・ｨ - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - C:\WINDOWS\WORLD2\TOOLBAR\hmtoolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Adobe\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [RavTimer] D:\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] D:\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [RfwMain] "D:\Rav\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Download all by Net Transport - D:\NetTransport\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - D:\NetTransport\NTAddLink.html
O8 - Extra context menu item: 添加到QQ自定?面板 - D:\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信?送??片 - D:\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: ｵｼｳｱﾇｰﾒｳｵｽｳｬﾐﾇﾔﾄﾀﾀﾆ・&A) - D:\SSREADER\ss_all.htm
O8 - Extra context menu item: ｵｼｳ｡ﾖﾐｲｿｷﾖｵｽｳｬﾐﾇﾔﾄﾀﾀﾆ・&S) - D:\SSREADER\ss_select.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Java コンソール (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: 信息?索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ﾒﾗﾈ､ｹｺﾎ・ - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra 'Tools' menuitem: ﾒﾗﾈ､ｹｺﾎ・ - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -
O16 - DPF: {E3489C0D-D07D-4281-A4A7-ADA8E9A0893F} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/cn/filesharingctrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CEF6F4FD-E24D-4664-90A4-45DDF494A3CB}: NameServer = 202.96.64.68,210.52.149.2
O18 - Protocol: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINDOWS\System32\mbprot.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: apihookdll.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\rav\rfw\rfwsrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RAV\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\system32\drivers\UPS.exe

用hijackthis扫个日志贴上来

杀软报路径,我想你中了灰鸽子的新品种了

我之前也中过灰鸽子，还是最初的应该不是新的变种，也是用我正版瑞星杀不掉，安全模式手工清除失败（可能是偶菜的原因吧）后来在网上找清除办法，看到说金山可以，说是什么提前预防。。我也不清楚，就下了个金山2005，安了，升级到最高版本，杀毒，完了重起，再查，没有了，后来用灰鸽子官方的检测也没有了
呵呵，我可没有为金山打广告的意思，我的却是这样杀的，拿出来分享，你可以去试试，要是杀不了也不要怪我呀~~~

发2个工具，不知道能不能帮上楼主
传不上来啊，说是文件类型不对，不让传附件。。。

病毒名：Backdoor.Gpigeon.4.an

情况和楼主一样的情况，杀了重起还有，安全模式什么也查不到。
是不是新毒啊，都服了~~