Backdoor.Gpigeon.2006.re
RootKit.Vanti.li
Trojan.StartPage.tau
日志
#T0 SecAnalyst 分析报告 版本:0, 4, 0, 47
#操作系统 : Microsoft Windows 2000 Professional Service Pack 4 (Build 2195) (CHS)
#系统目录 : C:\WINNT\system32
#浏览器  : Internet Explorer 5.00.3700.1000
#生成时间 : 2006-8-29 19:41:54

#T2 请把报告贴到安全救援中心bbs.s-sos.net,我们的专家会为你做出诊断，另外，报告中的安全风险值仅仅表示可疑程度。
#Q1 (请在此输入你的电脑遇到的问题和异常情况..)


#O4  危险    自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Yahoo Trojan Cleanner]-d:\progra~1\3721\ske\contmenu.dll
#O4  危险    自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Windows Script Host 的外壳扩展]-c:\winnt\system32\wshext.dll
#O4  警告    自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\RISING]-c:\winnt\system32\ravext.dll
#O4  警告    自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Shell Extensions for RealOne Player]-c:\program files\real\realplayer\rpshell.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\WinRAR shell extension]-c:\program files\winrar\rarext.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Message View]-d:\program files\nokia\nokia pc suite 6\messageview.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Contact View]-d:\program files\nokia\nokia pc suite 6\contactview.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\诺基亚手机浏览器]-d:\program files\nokia\nokia pc suite 6\phonebrowser.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\run\RfwMain]-"c:\program files\rising\rfw\rfwmain.exe" -startup
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Display Panning CPL Extension]-deskpan.dll [file not found]
#O4  低风险  自启动:[hkey_current_user\software\microsoft\windows\currentversion\run\MsnMsgr]-; "c:\program files\msn messenger\msnmsgr.exe" /background [file not found]
#O4  低风险  自启动:[hkey_current_user\software\microsoft\windows\currentversion\run\Super Rabbit IEPro]-; d:\program files\super rabbit\magicset\sriecli.exe /load [file not found]
#O4  低风险  自启动:[hkey_current_user\software\microsoft\windows\currentversion\run\PcSync]-; d:\program files\nokia\nokia pc suite 6\pcsync2.exe /nodialog [file not found]
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\run\TkBellExe]-; "c:\program files\common files\real\update_ob\realsched.exe"  -osboot [file not found]
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\run\DataLayer]-; c:\progra~1\common~1\pcsuite\datala~1\datala~1.exe [file not found]
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\run\PCSuiteTrayApplication]-; d:\program files\nokia\nokia pc suite 6\launch application 2.exe -onlytray [file not found]
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\nView Desktop Context Menu]-c:\winnt\system32\nvshell.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Desktop Explorer Menu]-c:\winnt\system32\nvshell.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Desktop Explorer]-c:\winnt\system32\nvshell.dll


#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\v124nt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\tonesnt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\spkpnt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\faxnt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\k56nt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\fsksnt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\fallback.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\basic2.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\amosnt.sys
#D0  低风险  驱动: C:\Program Files\Rising\Rav\ExpScan.sys
#D0  低风险  驱动: C:\Program Files\Rising\Rav\HOOKAPI.SYS
#D0  低风险  驱动: C:\Program Files\Rising\Rav\hookbase.sys
#D0  低风险  驱动: c:\program files\rising\rfw\RfwBase.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\RMSPPPOE.SYS
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\winachsf.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\rksample.sys
#D0  低风险  驱动: C:\WINNT\System32\Drivers\Cdralw2k.SYS
#D0  低风险  驱动: C:\WINNT\System32\Drivers\Cdr4_2K.SYS

#R0  警告    Homepage: http://www.cnool.net/ - HKCU\Software\Microsoft\Internet Explorer\Main, Start Page


#O2  警告    BHO: {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll

#O3  警告    Toolbar: {43869BB3-22FD-4F15-9B46-238106BA2F4E} - 超级兔子上网精灵 - D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
#O3  警告    Toolbar: {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} -  - C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll

#M0  危险    DLL:D:\Program Files\Super Rabbit\MagicSet\gdiplus.dll
#M0  警告    DLL:C:\WINNT\padyce.DLL
#M0  警告    DLL:D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
#M0  低风险  DLL:C:\WINNT\system32\vbscript.dll
#M0  低风险  DLL:C:\WINNT\system32\jscript.dll
#M0  低风险  DLL:C:\WINNT\system32\nvshell.dll

#P0  危险    进程:c:\program files\rising\rfw\rfwsrv.exe
#P0  危险    进程:c:\program files\rising\rav\ravmond.exe
#P0  警告    进程:c:\program files\rising\rav\rav.exe
#P0  警告    进程:c:\program files\rising\rav\ravstub.exe
#P0  低风险  进程:c:\program files\rising\rfw\rfwmain.exe
#P0  低风险  进程:c:\program files\rising\rav\rslogvw.exe

#S0  危险    NT 服务: Iion Driver Extensi - 启动方式: 已禁用 - 当前状态: 已停止 - C:\WINNT\padyce.exe
#S0  危险    NT 服务: RfwService - 启动方式: 自动 - 当前状态: 已启动 - c:\program files\rising\rfw\rfwsrv.exe
#S0  危险    NT 服务: RsRavMon - 启动方式: 自动 - 当前状态: 已启动 - "C:\Program Files\Rising\Rav\Ravmond.exe"
#S0  警告    NT 服务: WmdmPmSN - ServiceDll - C:\WINNT\system32\mspmsnsv.dll




您的电脑整体安全风险为中(78分)，请尽快咨询安全专家，协助处理!

Backdoor.Gpigeon.gwq
又查到一个病毒。这四个病毒要怎么删除啊

Logfile of HijackThis v1.99.1
Scan saved at 19:26:23, on 2006-8-29
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINNT\system32\internat.exe
D:\Program Files\Tencent\QQ\QQ.exe
D:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\Program Files\Rising\Rav\CopyRun\RavCopy.exe
D:\Program Files\Tencent\QQ\qqpet\qqpet.exe
C:\Program Files\Rising\Rav\Rav.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\华视影院\新建文件夹\HijackThis.exe

O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [PCSuiteTrayApplication] ; D:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] ; C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [PcSync] ; D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Super Rabbit IEPro] ; D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O4 - HKCU\..\Run: [MsnMsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O8 - Extra context menu item: &使用迅雷下载 - d:\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\浩方对战平台\GameClient.exe
O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WINNT\system32\shdocvw.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5599CE1-C0FC-420B-8ED3-059C6609A385}: NameServer = 202.96.104.16 202.96.104.26
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

每人会删吗？

奇怪HIJACKTHIS里面看出什么问题……