瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】中了Backdoor.Gpigeon.uql病毒如何完全清除？？？

1   1  /  1  页   跳转页

【求助】中了Backdoor.Gpigeon.uql病毒如何完全清除？？？

收藏
xdhu
头像
快乐黄口狮
  • 帖子:141
  • 注册: 2004-03-21
  • 来自:
发表于： 2006-08-09 03:54 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

【求助】中了Backdoor.Gpigeon.uql病毒如何完全清除？？？

2006-08-08,03:32:44

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [Microsoft Corporation]
    <Gainward><D:\WINNT\TBPanel.exe /A>  [Gainward Co.]
    <NvCplDaemon><RUNDLL32.EXE NvQTwk,NvCplDaemon initialize>  []
    <nwiz><nwiz.exe /install>  [NVIDIA Corporation]
    <IMSCMIG40W><D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log>  [Microsoft Corporation]
    <SKYNET Personal FireWall><D:\PROGRA~1\SkyNet\Firewall\PFW.exe>  [sky.net.cn]
    <SyGateManager><D:\Program Files\SyGate\SHN\Sygate.exe>  [赛格特（Sygate）技术有限公司]
    <RavTask><"D:\Program Files\rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <CheckFaultKernel><D:\WINNT\system32\mswdm.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><D:\WINNT\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><D:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
[Adobe Gamma Loader]
  <D:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <D:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[WebServer / GrayWebServer]
  <D:\WINNT\service.com><N/A>
[NVIDIA Driver Helper Service / NVSvc]
  <D:\WINNT\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
  <"D:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"D:\Program Files\rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SyGateService / SaService]
  <D:\Program Files\SyGate\SHN\sgserv.exe><Sygate technologies Inc.>
[Windows Vistra Xp / Windows Vistra Xp]
  <D:\WINNT\system.com><N/A>

==================================
浏览器加载项
[Yahoo! Toolbar Helper]
  {02478D38-C3F9-4EFB-9B51-7695ECA05670} <D:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[MemoryManager Class]
  {2CE7166E-8BBA-4E76-BA7E-02AB3C573011} <D:\WINNT\DOWNLO~1\cytdcli.dll, 北京创原天地科技有限公司>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Yahoo! IE Services Button]
  {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} <D:\Program Files\Yahoo!\Common\yiesrvc.dll, Yahoo! Inc.>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\PROGRA~1\FlashGet\jccatch.dll, Amaze Soft>
[shdocvwhlp Class]
  {BE442802-3911-46E0-B227-076B15A4EAD3} <D:\WINNT\system32\mssnmp16.dll, MicroCropration>
[NetAnts]
  {57E91B47-F40A-11D1-B792-444553540000} <D:\PROGRA~1\NetAnts\NetAnts.exe,  >
[Yahoo! IE Services Button]
  {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} <D:\Program Files\Yahoo!\Common\yiesrvc.dll, Yahoo! Inc.>
[CibaCtrl Class]
  {8DE0FCD4-5EB5-11D3-AD25-00002100131B} <D:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
[JoyoCtrl Class]
  {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} <D:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[精彩游戏]
  {D1EDDE84-E67E-4ccd-B28E-73AD3B71A7C9} <http://bars.duole8.com/, N/A>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\PROGRA~1\FlashGet\flashget.exe, Amaze Soft>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Yahoo! Messenger]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe, Yahoo! Inc.>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <D:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[Yahoo! Toolbar]
  {EF99BD32-C1FB-11D2-892F-0090271D4F88} <D:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
[VTPlug3 Class]
  {0400AC1C-EEF0-4638-A501-31D5A0DC2002} <D:\WINNT\Downloaded Program Files\VTrans3.dll, >
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <D:\WINNT\system32\CMBEdit.dll, >
[YInstStarter Class]
  {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} <D:\Program Files\Yahoo!\Common\yinsthelper.dll, Yahoo! Inc.>
[WEBChatRoomOCX Control]
  {448A5F6B-8C03-4B54-A338-F00237C508AD} <D:\PROGRA~1\Sina\UCWEBC~1\UCWEBC~1.OCX, 北京新浪信息技术有限公司>
[IMCv1 Control]
  {6924091F-CD97-41E1-B1D4-D9079409D413} <D:\WINNT\DOWNLO~1\imcv1.dll, 北京莲塘软件技术有限公司 Liantang Software Tech. Inc. (http://www.lotuspond.com.cn)>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <D:\WINNT\DOWNLO~1\INPUTC~1.DLL, >
[IEDown Class]
  {99888952-AC62-437C-AFC6-7B5CF05A7F2F} <D:\WINNT\system32\GLIEDown.dll, N/A>
[Update Class]
  {9F1C11AA-197B-4942-BA54-47A8489BB47F} <D:\WINNT\System32\iuctl.dll, Microsoft Corporation>
[GLWebAvt Control]
  {C14D003A-DA41-4FEE-8204-62A94EAA29D1} <D:\WINNT\DOWNLO~1\GLWebAvt.ocx, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINNT\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[Cytd Encipherment Memory]
  {F381FC65-D92D-4410-B865-E4E9713994E8} <D:\WINNT\DOWNLO~1\cytdcli.dll, 北京创原天地科技有限公司>
[&Yahoo! Search]
  <file:///D:\Program Files\Yahoo!\Common/ycsrch.htm, N/A>
[Yahoo! &Dictionary]
  <file:///D:\Program Files\Yahoo!\Common/ycdict.htm, N/A>
[Yahoo! &Maps]
  <file:///D:\Program Files\Yahoo!\Common/ycmap.htm, N/A>
[Yahoo! &SMS]
  <file:///D:\Program Files\Yahoo!\Common/ycsms.htm, N/A>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <D:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <D:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\qq\SendMMS.htm, N/A>
最后编辑2006-08-13 19:15:53
分享到：
gototop
 
xdhu
头像
快乐黄口狮
  • 帖子:141
  • 注册: 2004-03-21
  • 来自:
发表于： 2006-08-09 03:55 | 只看楼主 短消息 资料
字号： 小 中 大 2楼

正在运行的进程
[PID: 144][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 168][\??\D:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 188][\??\D:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6970>
    [D:\WINNT\system32\tssoft32.acm]  <DSP GROUP, INC.><1.01>
    [D:\WINNT\system32\tsd32.dll]  <N/A><N/A>
    [D:\WINNT\System32\iac25_32.ax]  <Intel Corporation><2.05.53>
    [D:\WINNT\system32\l3codeca.acm]  <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
[PID: 216][D:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.6700>
    [D:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 228][D:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.6902>
[PID: 388][D:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 416][D:\Program Files\rising\Rav\CCenter.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 432][D:\Program Files\rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
    [D:\Program Files\rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [D:\Program Files\rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [D:\Program Files\rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [D:\Program Files\rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [D:\Program Files\rising\Rav\HOOKSYS.dll]  <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
    [D:\Program Files\rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [D:\Program Files\rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [D:\Program Files\rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [D:\Program Files\rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [D:\Program Files\rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 2>
    [D:\Program Files\rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [D:\Program Files\rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [D:\Program Files\rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [D:\Program Files\rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [D:\Program Files\rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [D:\Program Files\rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [D:\Program Files\rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 14>
    [D:\Program Files\rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [D:\Program Files\rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [D:\Program Files\rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [D:\Program Files\rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [D:\Program Files\rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 476][D:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.7059>
[PID: 512][D:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 604][D:\WINNT\system32\stisvc.exe]  <Microsoft Corporation><5.00.2195.6656>
[PID: 744][D:\Program Files\rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [D:\Program Files\rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [D:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 700][D:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 960][D:\Program Files\SyGate\SHN\sgserv.exe]  <Sygate technologies Inc.><4.0.0.1>
    [D:\Program Files\SyGate\SHN\salic.dll]  <N/A><N/A>
    [D:\Program Files\SyGate\SHN\sasrv.dll]  <N/A><N/A>
    [D:\Program Files\SyGate\SHN\Netport.dll]  <N/A><N/A>
    [D:\Program Files\SyGate\SHN\wsman.dll]  <SyberGen Networks, Inc.><2, 3, 3114, 0>
    [D:\Program Files\SyGate\SHN\wgman.dll]  <SyberGen Networks, Inc.><1.01.1221>
    [D:\Program Files\SyGate\SHN\natsrv.dll]  <N/A><N/A>
    [D:\Program Files\SyGate\SHN\DhcpSrv.dll]  <N/A><N/A>
[PID: 2188][D:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [D:\WINNT\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><7.0.0.2004121400>
    [D:\PROGRA~1\FlashGet\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [D:\WINNT\system32\mssnmp16.dll]  <MicroCropration><1, 0, 0, 1>
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
    [D:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [D:\PROGRA~1\Yahoo!\Common\ymmapi.dll]  <Yahoo! Inc.><2004, 11, 23, 1>
[PID: 2192][D:\WINNT\TBPanel.exe]  <Gainward Co.><2.86>
    [D:\WINNT\TBManage.dll]  <N/A><N/A>
[PID: 824][D:\PROGRA~1\SkyNet\Firewall\PFW.exe]  <sky.net.cn><2.6.0.123>
[PID: 796][D:\Program Files\SyGate\SHN\Sygate.exe]  <赛格特（Sygate）技术有限公司><4.5.850.1>
    [D:\Program Files\SyGate\SHN\AREdt.dll]  <><1, 0, 0, 1>
    [D:\Program Files\SyGate\SHN\SaSrvAd.dll]  <赛格特（Sygate）技术有限公司><4.5.850.1>
    [D:\Program Files\SyGate\SHN\Netport.dll]  <N/A><N/A>
    [D:\Program Files\SyGate\SHN\wsman.dll]  <SyberGen Networks, Inc.><2, 3, 3114, 0>
    [D:\Program Files\SyGate\SHN\wgman.dll]  <SyberGen Networks, Inc.><1.01.1221>
    [D:\Program Files\SyGate\SHN\sasrv.dll]  <N/A><N/A>
    [D:\Program Files\SyGate\SHN\natsrv.dll]  <N/A><N/A>
    [D:\Program Files\SyGate\SHN\salic.dll]  <N/A><N/A>
    [D:\Program Files\SyGate\SHN\DhcpSrv.dll]  <N/A><N/A>
    [D:\Program Files\SyGate\SHN\CorpAd.dll]  <赛格特（Sygate）技术有限公司><4.5.850.1>
[PID: 972][D:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.1622>
[PID: 308][D:\Program Files\rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [D:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [D:\Program Files\rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 1000][D:\WINNT\system32\internat.exe]  <Microsoft Corporation><5.00.2920.0000>
[PID: 540][D:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
[PID: 2280][D:\Program Files\Tencent\TT\TTraveler.exe]  <腾讯公司><2, 2, 0, 224>
gototop
 
xdhu
头像
快乐黄口狮
  • 帖子:141
  • 注册: 2004-03-21
  • 来自:
发表于： 2006-08-09 03:56 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

[D:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  <腾讯公司><1, 1, 0, 5>
    [D:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\TT\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
    [D:\Program Files\rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\WINNT\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
    [D:\WINNT\system32\msdmo.dll]  <N/A><N/A>
[PID: 1100][D:\Documents and Settings\hxd\桌面\NewsBar3.1.exe]  <star><1.00>
    [D:\Program Files\rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\WINNT\System32\quartz.dll]  <N/A><N/A>
    [D:\WINNT\System32\devenum.dll]  <N/A><N/A>
    [D:\WINNT\system32\DVobSub.ax]  <Gabest><1, 0, 0, 9>
    [D:\WINNT\system32\RealMediaSplitter.ax]  <Gabest><1, 0, 0, 4>
    [D:\WINNT\system32\ac3filter.ax]  <><1.01a>
    [D:\WINNT\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
[PID: 2128][D:\Program Files\Winamp\Winamp.exe]  <Nullsoft><2.80>
    [D:\Program Files\Winamp\Plugins\in_cdda.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\in_midi.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\read_file.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\in_mod.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\in_mp3.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\in_vorbis.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\in_wave.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\in_wm.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\out_disk.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\out_ds.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\out_wave.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\out_wm.dll]  <N/A><N/A>
[PID: 1992][D:\Program Files\rising\Rav\RsAgent.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [D:\Program Files\rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 1616][D:\WINNT\msagent\AgentSvr.exe]  <Microsoft Corporation><2.00.0.3422>
[PID: 2252][D:\DOCUME~1\hxd\LOCALS~1\Temp\foxrar.exe]  <Alexander Roshal><3.60.2.0>
    [D:\DOCUME~1\hxd\LOCALS~1\Temp\so.dll]  <Microsoft Corporation><5.00.1764.1>
    [D:\DOCUME~1\hxd\LOCALS~1\Temp\packet.dll]  <CACE Technologies><3, 1, 0, 27>
    [D:\DOCUME~1\hxd\LOCALS~1\Temp\WanPacket.dll]  <CACE Technologies><3, 1, 0, 27>
[PID: 1168][D:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
[PID: 1044][C:\Downloads\sreng2(1)\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
.TXT  Error. [notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /s]
.CHM  Error. [hh.exe %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  Error. [wscript.exe "%1" %*]
.JS  Error. ["D:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1"]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
gototop
 
xdhu
头像
快乐黄口狮
  • 帖子:141
  • 注册: 2004-03-21
  • 来自:
发表于： 2006-08-09 04:22 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

HijackThis_815汉化版扫描日志 V1.99.1
保存于 3:48:58, 日期 2006-8-8
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\rising\Rav\CCenter.exe
D:\Program Files\rising\Rav\Ravmond.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\stisvc.exe
D:\Program Files\rising\Rav\RavStub.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\SyGate\SHN\sgserv.exe
D:\WINNT\Explorer.EXE
D:\WINNT\TBPanel.exe
D:\PROGRA~1\SkyNet\Firewall\PFW.exe
D:\Program Files\SyGate\SHN\Sygate.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\rising\Rav\RavTask.exe
D:\WINNT\system32\internat.exe
D:\WINNT\system32\conime.exe
D:\Program Files\Tencent\TT\TTraveler.exe
D:\Documents and Settings\hxd\桌面\NewsBar3.1.exe
D:\Program Files\rising\Rav\RsAgent.exe
D:\WINNT\msagent\AgentSvr.exe
D:\DOCUME~1\hxd\LOCALS~1\Temp\foxrar.exe
D:\WINNT\system32\conime.exe
D:\WINNT\notepad.exe
D:\Program Files\FlashGet\flashget.exe
C:\Downloads\Hijackthis1991zww\HijackThis1991zww.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MemoryManager Class - {2CE7166E-8BBA-4E76-BA7E-02AB3C573011} - D:\WINNT\DOWNLO~1\cytdcli.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: shdocvwhlp Class - {BE442802-3911-46E0-B227-076B15A4EAD3} - D:\WINNT\system32\mssnmp16.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll
O3 - IE工具栏增项: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [Gainward] D:\WINNT\TBPanel.exe /A
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [IMSCMIG40W] D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log
O4 - 启动项HKLM\\Run: [SKYNET Personal FireWall] D:\PROGRA~1\SkyNet\Firewall\PFW.exe
O4 - 启动项HKLM\\Run: [SyGateManager] D:\Program Files\SyGate\SHN\Sygate.exe
O4 - 启动项HKLM\\Run: [RavTask] "D:\Program Files\rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - IE右键菜单中的新增项目: &Yahoo! Search - file:///D:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - IE右键菜单中的新增项目: Yahoo! &Dictionary - file:///D:\Program Files\Yahoo!\Common/ycdict.htm
O8 - IE右键菜单中的新增项目: Yahoo! &Maps - file:///D:\Program Files\Yahoo!\Common/ycmap.htm
O8 - IE右键菜单中的新增项目: Yahoo! &SMS - file:///D:\Program Files\Yahoo!\Common/ycsms.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Program Files\Tencent\qq\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\qq\SendMMS.htm
O9 - 浏览器额外的按钮: NetAnts - {57E91B47-F40A-11D1-B792-444553540000} - D:\PROGRA~1\NetAnts\NetAnts.exe
O9 - 浏览器额外的“工具”菜单项: &NetAnts - {57E91B47-F40A-11D1-B792-444553540000} - D:\PROGRA~1\NetAnts\NetAnts.exe
O9 - 浏览器额外的按钮: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - 浏览器额外的按钮: 卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - D:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - 浏览器额外的按钮: 金山词霸 - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - D:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: 精彩游戏 - {D1EDDE84-E67E-4ccd-B28E-73AD3B71A7C9} - http://bars.duole8.com/ (file missing)
O9 - 浏览器额外的“工具”菜单项: 精彩游戏 - {D1EDDE84-E67E-4ccd-B28E-73AD3B71A7C9} - http://bars.duole8.com/ (file missing)
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的按钮: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - 浏览器额外的“工具”菜单项: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O16 - DPF: {0400AC1C-EEF0-4638-A501-31D5A0DC2002} (VTPlug3 Class) - http://61.152.96.12:1995/VTrans.cab
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - D:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {448A5F6B-8C03-4B54-A338-F00237C508AD} (WEBChatRoomOCX Control) - http://www.51uc.com/cab/WEBChatRoom_1_39.cab
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://61.152.96.12:1995/talk.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {99888952-AC62-437C-AFC6-7B5CF05A7F2F} (IEDown Class) - http://download.ourgame.com/IEDown.cab
O16 - DPF: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - http://bar.baidu.com/update/IESearch.cab
O16 - DPF: {C14D003A-DA41-4FEE-8204-62A94EAA29D1} (GLWebAvt Control) - http://bbs.ourgame.com/image/GLWebAvt.cab
O16 - DPF: {F381FC65-D92D-4410-B865-E4E9713994E8} (Cytd Encipherment Memory) - http://202.99.42.177/sso/ccitpay.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{E952FEAF-E758-48F5-868E-96812E4C170D}: NameServer = 202.106.0.20 202.106.46.151
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - NT 服务: WebServer (GrayWebServer) - Unknown owner - D:\WINNT\service.com
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINNT\System32\nvsvc32.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\rising\Rav\Ravmond.exe
O23 - NT 服务: SyGateService (SaService) - Sygate technologies Inc. - D:\Program Files\SyGate\SHN\sgserv.exe
O23 - NT 服务: Windows Vistra Xp - Unknown owner - D:\WINNT\system.com
gototop
 
xdhu
头像
快乐黄口狮
  • 帖子:141
  • 注册: 2004-03-21
  • 来自:
发表于： 2006-08-09 04:26 | 只看楼主 短消息 资料
字号： 小 中 大 5楼

阅读"关于查杀“灰鸽子2005”的一点建议"后觉得
O23 - NT 服务: WebServer (GrayWebServer) - Unknown owner - D:\WINNT\service.com
O23 - NT 服务: Windows Vistra Xp - Unknown owner - D:\WINNT\system.com
是不是这两个是病毒？高人指点(特别是超凡脱俗之baohe)！
gototop
 
cmy1987110
头像
初生襁褓狮
  • 帖子:89
  • 注册: 2006-08-09
  • 来自:
发表于： 2006-08-09 06:46 | 短消息 资料
字号： 小 中 大 6楼

我也中了和你一样的病毒````
高人快来救我们啊。。
gototop
 
xdhu
头像
快乐黄口狮
  • 帖子:141
  • 注册: 2004-03-21
  • 来自:
发表于： 2006-08-10 19:22 | 只看楼主 短消息 资料
字号： 小 中 大 7楼

高人快来帮忙
gototop
 
mopery
头像
卡卡技术团队
  • 帖子:17737
  • 注册: 2005-12-06
  • 来自:New York
卡卡名人堂论坛9周年纪念
发表于： 2006-08-10 19:48 | 短消息 资料
字号： 小 中 大 8楼

[WebServer / GrayWebServer]
<D:\WINNT\service.com><N/A>
[Windows Vistra Xp / Windows Vistra Xp]
<D:\WINNT\system.com><N/A>
鸽子..安全模式...打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索GrayWebServer和Windows Vistra Xp 删除..
删除
D:\WINNT\service.com
D:\WINNT\system.com

打开SRE 启动项目 注册表 删除
<CheckFaultKernel><D:\WINNT\system32\mswdm.exe> []
删除
D:\WINNT\system32\mswdm.exe

修复
O2 - BHO: shdocvwhlp Class - {BE442802-3911-46E0-B227-076B15A4EAD3} - D:\WINNT\system32\mssnmp16.dll
删除
D:\WINNT\system32\mssnmp16.dll

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)
gototop
 
xdhu
头像
快乐黄口狮
  • 帖子:141
  • 注册: 2004-03-21
  • 来自:
发表于： 2006-08-13 18:57 | 只看楼主 短消息 资料
字号： 小 中 大 9楼

谢谢mopery ！为何mssnmp16.dll的日期在2004年？不是今年的？
gototop
 
ydc4094
头像
初生襁褓狮
  • 帖子:2
  • 注册: 2006-07-08
  • 来自:
发表于： 2006-08-13 19:23 | 短消息 资料
字号： 小 中 大 10楼

XP系统将如何彻底完全清除Backdoor.Gpigeon.uql病毒呢？谢谢，请指教。
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT