我开机总是杀 Backdoor.Gpigeon.ukg “灰鸽子”后门，能让远程计算机控制本地计算机。
Logfile of HijackThis v1.99.1
Scan saved at 23:44:43, on 2006-2-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\系统安全\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\系统安全\Rising\Rav\Ravmond.exe
d:\系统安全\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
D:\系统安全\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
D:\系统安全\Rising\Rav\RavTask.exe
D:\系统安全\Rising\Rav\Ravmon.exe
d:\系统安全\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\系统安全\Rising\Rav\Rav.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Thunder Network\Thunder\Thunder.exe
C:\WINDOWS\system32\svchost.exe
C:\DOCUME~1\华正兴\LOCALS~1\Temp\Rar$EX00.504\HijackThis.exe
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v13.dll
O2 - BHO: QuickBtn - {1A199C20-DE2B-4838-AE3F-B5257ECE2B7E} - C:\Program Files\CoolWebsite\QuickLink.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll (file missing)
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - D:\学习工具\金山快译2006\IEBand.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - HKLM\..\Run: [RavTask] "D:\系统安全\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "D:\系统安全\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\聊天软件\QQ2006贺岁版\AddToNetDisk.htm
O8 - Extra context menu item: 加入POCO网摘(&K) - http://my.poco.cn/fav/rightClick.php
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\学习工具\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 我的POCO网摘(&O) - http://my.poco.cn/fav/open_myfav.php
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\聊天软件\QQ2004正式版\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\聊天软件\QQ2004正式版\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\聊天软件\QQ2004正式版\SendMMS.htm
O9 - Extra button: 实用网址导航 - {1D901067-2529-4A9B-9B6B-7A1DB3A44CB5} - C:\Program Files\CoolWebsite\QuickLink.dll
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\学习工具\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: 易趣购物 - {DE607141-AC19-421e-866A-6D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607141-AC19-421e-866A-6D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O14 - IERESET.INF: START_PAGE_URL=
about:blank
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D25701E-F64C-40C0-A469-783CD1CBD6E2}: NameServer = 211.93.80.129,211.94.33.193
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D25701E-F64C-40C0-A469-783CD1CBD6E2}: NameServer = 211.93.80.129,211.94.33.193
O17 - HKLM\System\CS2\Services\Tcpip\..\{0D25701E-F64C-40C0-A469-783CD1CBD6E2}: NameServer = 211.93.80.129,211.94.33.193
O23 - Service: Internet Connection Firewall - Unknown owner - C:\WINDOWS\TASKMAM.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\系统安全\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\系统安全\rising\rfw\rfwsrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\系统安全\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\系统安全\Rising\Rav\Ravmond.exe
O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing)
O23 - Service: Network System (Universal Disk Manager) - Unknown owner - C:\Program Files\Common Files\COMM\Network.exe (file missing)
