瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 中了灰鸽子病毒了,用hijackthis里分析出来的!灰鸽子文件找不到·

1   1  /  1  页   跳转

中了灰鸽子病毒了,用hijackthis里分析出来的!灰鸽子文件找不到·

中了灰鸽子病毒了,用hijackthis里分析出来的!灰鸽子文件找不到·

这个是hijackthis的报告:
Logfile of HijackThis v1.99.1
Scan saved at 19:54:53, on 2006-4-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AhnLab\Smart Update Utility\AhnSDsv.exe
C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe
C:\Program Files\AhnLab\AhnLab Personal Firewall 2005\NssTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\tuzi\MagicSet\SRIECLI.EXE
C:\Program Files\Messenger\msmsgs.exe
G:\QQ\QQ.exe
G:\QQ\TIMPlatform.exe
C:\Program Files\AhnLab\AhnLab Personal Firewall 2005\NssServ.exe
C:\Program Files\AhnLab\APC2\Policy Agent\pasvc.exe
C:\WINDOWS\system32\ServiceP.exe
C:\Program Files\Ahnlab\V3\MonSysNT.exe
C:\Program Files\Ahnlab\V3\V3P3AT.exe
C:\Program Files\AhnLab\AhnLab SpyZero 2.0\AszTray.exe
C:\Program Files\AhnLab\AhnLab SpyZero 2.0\AszMon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\mspps.exe
C:\PROGRA~1\Ahnlab\V3\MonSvcNT.exe
C:\PROGRA~1\Ahnlab\V3\V3IMPro.exe
G:\复件.exe

R3 - URLSearchHook: SgUrlSearHook Class - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - C:\WINDOWS\system32\socul.dll
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - (no file)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - G:\QQ\QQIEHelper.dll
O2 - BHO: V3 - {76EAE03C-F2B1-4397-97E8-390920B7C2DC} - C:\Program Files\Ahnlab\V3\V3Bar.dll
O2 - BHO: 超级兔子上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - G:\tuzi\MagicSet\HaokanBar.dll
O3 - Toolbar: V3 - {9E3849D6-41EF-4B2F-86B7-632EF90758E4} - "C:\Program Files\Ahnlab\V3\V3Bar.dll" (file missing)
O3 - Toolbar: 超级兔子上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - G:\tuzi\MagicSet\HaokanBar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [KVautoupdate ] ; C:\Program Files\KV2006\kvolself.exe /silent
O4 - HKLM\..\Run: [SigmatelSysTrayApp] ; stsystra.exe
O4 - HKLM\..\Run: [StatusClient 2.6] ; C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] ; C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [HP Software Update] ; "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [paTray] "C:\Program Files\AhnLab\APC2\Policy Agent\patray.exe"
O4 - HKLM\..\Run: [AHNSD] "C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe"
O4 - HKLM\..\Run: [NssTray] "C:\Program Files\AhnLab\AhnLab Personal Firewall 2005\NssTray.exe"
O4 - HKLM\..\Run: [SysExplr] ; C:\Herosoft\HeroV8\SysExplr.EXE
O4 - HKLM\..\Run: [mstasks.exe] ; C:\WINDOWS\system32\mspps.exe
O4 - HKLM\..\Run: [Dot1XAutoRun] C:\Program Files\Huawei-3Com\H3C 认证客户端\H3C Client.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [supdate2.dll] RUNDLL32.EXE C:\WINDOWS\system32\supdate2.dll,Run
O4 - HKCU\..\Run: [ctfmon.exe] ; C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Super Rabbit IEPro] G:\tuzi\MagicSet\SRIECLI.EXE /LOAD
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [pbmini] C:\Program Files\pcast\PodcastbarMini\PodcastBarMiniStater.exe
O4 - Startup: 腾讯QQ.lnk = G:\QQ\QQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &使用迅雷下载 - G:\xunlei\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - G:\xunlei\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - G:\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - G:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - G:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - G:\QQ\SendMMS.htm
O9 - Extra button: (no name) - {35980F6E-A137-4E50-953D-813BB8556899}_dummy_ - (no file)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - G:\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - G:\QQ\QQIEHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B2989E9-61C7-401D-AB0F-7A4A23D032F4}: NameServer = 202.102.192.68
O20 - Winlogon Notify: System Safety Monitor - C:\WINDOWS\SYSTEM32\SSMWinlogonEx.dll
O23 - Service: AhnLab Task Scheduler - AhnLab, Inc. - C:\Program Files\AhnLab\Smart Update Utility\AhnSDsv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - C:\WINDOWS\G_Server.exe (file missing)
O23 - Service: MonSvcNT - AhnLab, Inc. - C:\PROGRA~1\Ahnlab\V3\MonSvcNT.exe
O23 - Service: NSS Main Service (NssService) - AhnLab, Inc. - C:\Program Files\AhnLab\AhnLab Personal Firewall 2005\NssServ.exe
O23 - Service: Policy Agent Service V2.5 (paSvc) - AhnLab, Inc. - C:\Program Files\AhnLab\APC2\Policy Agent\pasvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceP - Unknown owner - C:\WINDOWS\system32\ServiceP.exe
O23 - Service: SpyZero_Monitor - AhnLab, Inc. - C:\Program Files\AhnLab\AhnLab SpyZero 2.0\AszMon.exe

请各位大大帮忙看下,感激不尽啊!!!!!!
最后编辑2006-04-10 21:34:28
分享到:
gototop
 

O23 - Service: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - C:\WINDOWS\G_Server.exe (file missing)

为什么文件找不到呢?那怎么办?
gototop
 

O23 - Service: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - C:\WINDOWS\G_Server.exe (file missing)

  进安全模式...
gototop
 

是不是先删除023项?然后进入安全模式删除文件呢?那注册表怎么办呢?
gototop
 

直接进安全模式...在WINDOWS找到此文件(找不到就搜索) ...删除...


然后进注册表...展开HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services  搜索GrayPigeonServer  删除..即可


O23 - Service: ServiceP - Unknown owner - C:\WINDOWS\system32\ServiceP.exe

同样的处理方法...注册表地方一样...搜索
ServiceP  删除...
gototop
 

谢谢!!017项是否是劫持的域呢?
gototop
 

不怎么清楚 ...如果怕的话...用卡卡助手修复一下...
gototop
 

我给他修复了...现在进入安全模式
gototop
 

开始—设置-控制面板,在“文件夹选项”中的”查看”选项卡下勾选“显示所有文件和文件夹”、“取消”隐藏受保护的操作系统文件(推荐)”前的勾”
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT