请风之咏者大侠帮我分析一下 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛请风之咏者大侠帮我分析一下

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第四十七次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

请风之咏者大侠帮我分析一下

zhaolaoda 初生襁褓狮帖子:3 注册: 2005-10-29 来自:	发表于： 2005-10-30 13:27 \| 只看楼主短消息资料字号：小中大 1楼请风之咏者大侠帮我分析一下我中灰鸽子Backdoor.GPigeon.sgr 病毒了，请风之咏者大侠分析一下，谢谢了 Logfile of HijackThis v1.99.1 Scan saved at 10:17:00, on 2005-10-30 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\PROGRAM FILES\RISING\RAV\Ravmond.exe C:\PROGRAM FILES\RISING\RAV\RavStub.exe c:\program files\rising\rfw\rfwsrv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\PROGRA~1\Iomega\System32\ActivityDisk.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINNT\Explorer.EXE C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE C:\PROGRA~1\RISING\RAV\RAVMON.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINNT\system32\internat.exe C:\WINNT\System32\mgabg.exe C:\WINNT\system32\conime.exe C:\WINNT\system32\nvsvc32.exe C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\ZipToA.exe C:\Program Files\rising\Rav\RsAgent.exe C:\WINNT\msagent\AgentSvr.exe C:\Program Files\racer-henan-cnc\racer.exe C:\Program Files\racer-henan-cnc\RacerKp.exe C:\Program Files\BitComet\BitComet.exe C:\WINNT\system32\UPEngine.EXE C:\WINNT\NOTEPAD.EXE D:\Backdoor.GPigeon.sgr 病毒\HijackThis\HijackThis.exe F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Wbho Class - {40E3A34A-3282-41F8-AD2C-051BAB96AD4A} - C:\WINNT\system32\Usign.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\FGIEBAR.DLL O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\BitComet\BitCometBar\BitCometBar0.1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [RfwMain] C:\Program Files\rising\Rfw\rfwmain.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [Internat.exe] internat.exe O4 - Global Startup: 河南网通宽带用户客户端.lnk = C:\Program Files\racer-henan-cnc\racer.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\FLASHGET.EXE O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\FLASHGET.EXE O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=9f61b12a60c07eebdb4fc97ec168da8e90daa2eebae9c7525e5f878a37b676f935fd98ead5cd86ed7cb267a3cbe236b4146bf88f:adfe7cdda14abbf71198a73bd5be0348 O16 - DPF: {249527A2-0434-4D6D-BDC3-56D25BFD3A54} (SsPlugin90000102000011 Class) - http://file.digitallpark.co.kr/codebase/SsMana90000102000011.cab O16 - DPF: {8819C261-5B61-4628-908C-9BE795EABEC3} (IE Class) - http://www.95599.cn/download/ABC.cab O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: internetServer - Unknown owner - C:\WINNT\smiss.exe O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe O23 - Service: ll_reg - Unknown owner - Rundll32.exe (file missing) O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\System32\mgabg.exe O23 - Service: Microsoft NetWork FireWall Services - Unknown owner - NetServices.exe (file missing) O23 - Service: NetMeeting Remote Desktop (RPC) Sharing - Unknown owner - Rundll32.exe (file missing) O23 - Service: ELSA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - c:\program files\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe O23 - Service: Windows Management Instrumentation Driver Extension - Conexant - (no file) O23 - Service: ZipToA - Iomega Corporation - C:\WINNT\System32\ZipToA.exe 2005-10-31 02:31:48
zhaolaoda 初生襁褓狮帖子:3 注册: 2005-10-29 来自:	分享到：

花落花又开社区嘉宾帖子:6782 注册: 2005-04-16 来自:	发表于： 2005-10-30 13:47 \| 短消息资料字号：小中大 2楼【回复“zhaolaoda”的帖子】修复: O2 - BHO: Wbho Class - {40E3A34A-3282-41F8-AD2C-051BAB96AD4A} - C:\WINNT\system32\Usign.dll O23 - Service: internetServer - Unknown owner - C:\WINNT\smiss.exe O23 - Service: ll_reg - Unknown owner - Rundll32.exe (file missing) O23 - Service: Microsoft NetWork FireWall Services - Unknown owner - NetServices.exe (file missing) 停止服务:开始--控制面版--管理工具--服务--找到internetServer,ll_reg, Microsoft NetWork FireWall Services 属性--改成已禁用显示所有文件,找到以下删除:(如果有的话) C:\WINNT\system32\Usign.dll C:\WINNT\smiss.exe C:\WINNT\smiss.dll C:\WINNT\smisskey.dll C:\WINNT\smiss_Hook.dll
花落花又开社区嘉宾帖子:6782 注册: 2005-04-16 来自:

zhaolaoda 初生襁褓狮帖子:3 注册: 2005-10-29 来自:	发表于： 2005-10-30 22:31 \| 只看楼主短消息资料字号：小中大 3楼谢谢花开花又落大侠。我在开始--控制面版--管理工具--服务--没有找到internetServer项，怎么办？另外ll_reg, Microsoft NetWork FireWall Services 属性--改成已禁用。我找到了以下4个 C:\WINNT\system32\Usign.dll C:\WINNT\smiss.exe C:\WINNT\smiss.dll C:\WINNT\smiss_Hook.dll 已经删除就是没有C:\WINNT\smisskey.dll 重起后，用最新版瑞星查不到病毒了，不知道清理干净没有。 Logfile of HijackThis v1.99.1 Scan saved at 22:31:50, on 2005-10-30 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\PROGRAM FILES\RISING\RAV\Ravmond.exe C:\PROGRAM FILES\RISING\RAV\RavStub.exe c:\program files\rising\rfw\rfwsrv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\PROGRA~1\Iomega\System32\ActivityDisk.exe C:\WINNT\System32\mgabg.exe C:\WINNT\Explorer.EXE C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE C:\PROGRA~1\RISING\RAV\RAVMON.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINNT\system32\internat.exe C:\WINNT\system32\nvsvc32.exe C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\ZipToA.exe C:\Program Files\rising\Rav\RsAgent.exe C:\WINNT\msagent\AgentSvr.exe C:\Program Files\racer-henan-cnc\racer.exe C:\Program Files\racer-henan-cnc\RacerKp.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINNT\system32\UPEngine.EXE D:\Backdoor.GPigeon.sgr 病毒\HijackThis\HijackThis.exe F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Wbho Class - {40E3A34A-3282-41F8-AD2C-051BAB96AD4A} - C:\WINNT\system32\Usign.dll (file missing) O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\FGIEBAR.DLL O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\BitComet\BitCometBar\BitCometBar0.1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [RfwMain] C:\Program Files\rising\Rfw\rfwmain.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [Internat.exe] internat.exe O4 - Global Startup: 河南网通宽带用户客户端.lnk = C:\Program Files\racer-henan-cnc\racer.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\FLASHGET.EXE O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\FLASHGET.EXE O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=9f61b12a60c07eebdb4fc97ec168da8e90daa2eebae9c7525e5f878a37b676f935fd98ead5cd86ed7cb267a3cbe236b4146bf88f:adfe7cdda14abbf71198a73bd5be0348 O16 - DPF: {249527A2-0434-4D6D-BDC3-56D25BFD3A54} (SsPlugin90000102000011 Class) - http://file.digitallpark.co.kr/codebase/SsMana90000102000011.cab O16 - DPF: {8819C261-5B61-4628-908C-9BE795EABEC3} (IE Class) - http://www.95599.cn/download/ABC.cab O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: internetServer - Unknown owner - C:\WINNT\smiss.exe (file missing) O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\System32\mgabg.exe O23 - Service: NetMeeting Remote Desktop (RPC) Sharing - Unknown owner - Rundll32.exe (file missing) O23 - Service: ELSA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - c:\program files\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe O23 - Service: Windows Management Instrumentation Driver Extension - Conexant - (no file) O23 - Service: ZipToA - Iomega Corporation - C:\WINNT\System32\ZipToA.exe
zhaolaoda 初生襁褓狮帖子:3 注册: 2005-10-29 来自:

魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:	发表于： 2005-10-31 00:33 \| 短消息资料字号：小中大 4楼修复 O2 - BHO: Wbho Class - {40E3A34A-3282-41F8-AD2C-051BAB96AD4A} - C:\WINNT\system32\Usign.dll (file missing) 开始→设置→控制面板→管理工具→服务→查找internetServer、NetMeeting Remote Desktop (RPC) Sharing、Windows Management Instrumentation Driver Extension→右击→属性→启动类型→禁止→应用→停止→确定。
魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:

study2005 禁止访问帖子:258 注册: 2005-10-22 来自:	发表于： 2005-10-31 02:31 \| 短消息资料字号：小中大 5楼该用户帖子内容已被屏蔽
study2005 禁止访问帖子:258 注册: 2005-10-22 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT