我的系统是windows2000(package4),使用17.36.40版瑞星每次杀完，重启动后又在内存中出现了。使用了灰鸽子检查器查杀，根本发现不了服务器端灰鸽子。
Backdoor.Gpigeon.hw 感染：IEXPLORE.EXE>>C:\Program Files\Internet Explorer
\IEXPLORE.EXE
Trojan.Spy.VB.r 感染：csrss32.exe>>C:\WINNT\system32\csrss32.exe
下面是扫描信息：
Logfile of HijackThis v1.99.1
Scan saved at 23:39:33, on 2005-7-27
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINNT\System32\vmnat.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\vmnetdhcp.exe
C:\WINNT\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINNT\system32\asd\adtimer.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\conime.exe
C:\WINNT\system32\csrss32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\System32\MsiExec.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\huanjm\LOCALS~1\Temp\Rar$EX00.781\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} -
C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\program files\google\googletoolbar1.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} -
C:\PROGRA~1\3721\assist\asbar.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program
Files\Xi\NetTransport 2\NTIEHelper.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} -
C:\WINNT\DOWNLO~1\CONFLICT.1\CnsHook.dll
O2 - BHO: YMIN IEBand - {D4F7605B-084D-4353-A1E1-C1BC3161938C} -
C:\PROGRA~1\Yahoo!\MiniMsgr\ymini.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} -
C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: CyberArticle Express - {769A6A36-ED24-4376-BC7C-80225BF35698} -
D:\Program Files\CyberArticle\CyberArticleExpress.dll
O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} -
C:\PROGRA~1\3721\assist\asbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ats] C:\WINNT\system32\asd\adtimer.exe noshow
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe
C:\WINNT\DOWNLO~1\CONFLICT.1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [] CnsMin
O4 - HKLM\..\Run: [helper.dll] C:\WINNT\system32\rundll32.exe
C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\rising\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - Global Startup: 阿达自动定时关机器.exe
O8 - Extra context menu item: !搜一搜 -
res://C:\WINNT\DOWNLO~1\CONFLICT.1\CnsMinEx.dll/1003
O8 - Extra context menu item: &Google Search - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: 使用CyberArticle保存 - D:\Program
Files\CyberArticle\script\SaveX.htm
O8 - Extra context menu item: 使用CyberArticle保存当前网页 - D:\Program
Files\CyberArticle\script\Save.htm
O8 - Extra context menu item: 使用CyberArticle保存当前选中部分 - D:\Program
Files\CyberArticle\script\Savesel.htm
O8 - Extra context menu item: 使用彩信超级自写发送到手机 -
http://mms.sina.com.cn/mmsnews.html
O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport
2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program
Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 使用网际快车下载 - C:\Program
Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program
Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 反向链接 - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: 发送图片到手机(&M) -
http://sms.sina.com.cn/diy/send.html?from=20000001
O8 - Extra context menu item: 收藏此页到ViVi -
http://vivi.sina.com.cn/collect/click.php?agent=ddt
O8 - Extra context menu item: 新浪搜索 - http://cha.sina.com.cn/ddt.html
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program
Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program
Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program
