瑞星卡卡安全论坛

用瑞星查到电脑里有三个病毒,分别是

病毒名: Backdoor.Gpigeon.foj  文件名:IEXPLORE.EXE>>C://Program Files\Internet Explorer\IEXPLORE.EXE

病毒名: Backdoor.Gpigeon        文件名:system.dll        文件夹:C:\WINNT

病毒名: Backdoor.Gpigeon.2006.to      文件名: systemKey.dll      文件夹:C:\WINNT

我用瑞星杀过了,但重启电脑再查又发现有,好象不能彻底解决.....请高手帮忙一下,如何完全杀掉这些病毒?


以下是用System Repair Engineer扫描的日志,请高手帮忙看一下~~~


2006-08-11,13:00:25

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [Microsoft Corporation]
    <ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe">  [Symantec Corporation]
    <vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe>  [Symantec Corporation]
    <helper.dll><C:\WINNT\system32\rundll32.exe,Rundll32>  []
    <WinampAgent><rem C:\Program Files\Winamp\winampa.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
    <WinlogonNotify: NavLogon><C:\WINNT\system32\NavLogon.dll>  [Symantec Corporation]

==================================
启动文件夹
[腾讯QQ]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Symantec Event Manager / ccEvtMgr]
  <"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc]
  <"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
  <"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch]
  <"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[LexBce Server / LexBceS]
  <C:\WINNT\system32\LEXBCES.EXE><Lexmark International, Inc.>
[Microsoft SCSI Initiator / Microsoft SCSI Initiator]
  <C:\WINNT\G_Server.exe><N/A>
[SavRoam / SavRoam]
  <"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc]
  <"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus]
  <"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[win32 / win32]
  <C:\WINNT\G_Server1.23.exe><N/A>
[Windows Management Internet Drivers / Windows Internet Drivers]
  <C:\WINNT\system32\system.exe><N/A>
[Windows Internet Drivers / Windows Management Drivers]
  <C:\WINNT\system.exe><N/A>

==================================
浏览器加载项
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[NXIECatcher Class]
  {83B80A9C-D91A-4F22-8DCF-EA7204039F79} <C:\Program Files\Xi\NetXfer\NXIEHelper.dll, Xi>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[NetXfer]
  {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} <C:\Program Files\Xi\NetXfer\NXToolBar.dll, Xi>
[AddSHCARoot Control]
  {098A3F72-3110-4004-B954-2F9DC44934B4} <C:\WINNT\DOWNLO~1\ADDCAR~1.OCX, SHECA>
[Office Update Installation Engine]
  {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} <C:\WINNT\opuc.dll, Microsoft Corporation>
[PortalCom R01]
  {817C90B5-1688-42BE-9044-58422DB088B2} <C:\WINNT\DOWNLO~1\PortalAX.ocx, Huawei Co. Ltd.>
[Update Class]
  {9F1C11AA-197B-4942-BA54-47A8489BB47F} <C:\WINNT\system32\iuctl.dll, Microsoft Corporation>
[photo_uploader Control]
  {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINNT\DOWNLO~1\PHOTO_~1.OCX, N/A>
[WebActivater Control]
  {C661F36D-DF85-4EF4-83C7-E107B83D04B1} <C:\WINNT\system32\3DShowVM.ocx, QQ>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINNT\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网络传送带下载]
  <C:\Program Files\Xi\NetXfer\NXAddLink.html, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 136][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 164][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 160][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6785>
    [C:\WINNT\system32\MZWBJ.IME]  <明泽五笔><4.00.950>
    [C:\WINNT\system32\NavLogon.dll]  <Symantec Corporation><9.0.0.338>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
[PID: 212][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.6700>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 224][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.6695>
[PID: 400][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 428][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe]  <Symantec Corporation><2.2.0.577>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><2.2.0.577>
[PID: 456][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe]  <Symantec Corporation><2.2.0.577>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><2.2.0.577>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL]  <Symantec Corporation><2.2.0.577>
[PID: 552][C:\WINNT\system32\LEXBCES.EXE]  <Lexmark International, Inc.><9.42>
    [C:\WINNT\system32\lexp2p32.dll]  <Lexmark International, Inc.><9.42>
    [C:\WINNT\system32\lex2kusb.dll]  <Lexmark International, Inc.><9.42>
[PID: 576][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.6659>
    [C:\WINNT\system32\LEXLMPM.DLL]  <Lexmark International, Inc.><96.9.42>
    [C:\WINNT\system32\LexBce.dll]  <Lexmark International, Inc.><9.42>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
    [C:\WINNT\system32\MZWBJ.IME]  <明泽五笔><4.00.950>
    [C:\WINNT\system32\spool\PRTPROCS\W32X86\LVCMPP5C.dll]  <Lenovo (Beijing) Ltd.><1.0.1.14>
    [C:\WINNT\system32\LVCMpwr.dll]  <Lenovo (Beijing) Ltd.><1, 0, 1, 0>
[PID: 604][C:\WINNT\system32\LEXPPS.EXE]  <Lexmark International, Inc.><9.42>
    [C:\WINNT\system32\LEXBCE.DLL]  <Lexmark International, Inc.><9.42>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
[PID: 612][C:\Program Files\Symantec AntiVirus\DefWatch.exe]  <Symantec Corporation><9.0.0.338>
[PID: 644][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 748][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106>
    [C:\Program Files\Tencent\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\Program Files\Xi\NetXfer\NXIEHelper.dll]  <Xi><2.01.301>
    [C:\WINNT\system32\MZWBJ.IME]  <明泽五笔><4.00.950>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
[PID: 776][C:\WINNT\system32\regsvc.exe]  <Microsoft Corporation><5.00.2195.6701>
[PID: 848][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6704>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
[PID: 896][C:\Program Files\Symantec AntiVirus\Rtvscan.exe]  <Symantec Corporation><9.0.0.338>
    [C:\WINNT\system32\CBA.DLL]  <Intel? Corporation><6.12.0.112 E>
    [C:\WINNT\system32\MsgSys.dll]  <Intel? Corporation><6.12.0.112 E>
    [C:\WINNT\system32\NTS.dll]  <Intel? Corporation><6.12.0.112 E>
    [C:\WINNT\system32\PDS.DLL]  <Intel? Corporation><6.12.0.112 E>
    [C:\Program Files\Symantec AntiVirus\NAVLU.dll]  <Symantec Corporation><9.0.0.338>
    [C:\Program Files\Symantec AntiVirus\I2ldvp3.dll]  <Symantec Corporation><9.0.0.338>
    [C:\Program Files\Symantec AntiVirus\ecmldr32.DLL]  <Symantec Corp.><1.1.0.3>
    [C:\Program Files\Symantec AntiVirus\SAVRT32.DLL]  <Symantec Corporation><9.3.0.28>
    [C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL]  <Symantec Corporation><9.0.0.338>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060809.018\ecmsvr32.dll]  <Symantec Corporation><61.2.1.10>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060809.018\NAVEX32a.DLL]  <Symantec Corporation><20061.2.0.26>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060809.018\NAVENG32.DLL]  <Symantec Corporation><20061.2.0.26>
    [C:\Program Files\Symantec AntiVirus\IMail.dll]  <Symantec Corporation><9.0.0.338>
    [C:\Program Files\Symantec AntiVirus\NotesExt.dll]  <Symantec Corporation><9.0.0.338>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
    [C:\Program Files\Symantec AntiVirus\vpmsece.dll]  <Symantec Corporation><9.0.0.338>
    [C:\WINNT\TEMP\ubhc2mk.dll]  <WinRAR archiver><3, 4, 2, 0>
    [C:\Program Files\Symantec AntiVirus\DecSDK.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2ID.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2ZIP.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2SS.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2GZIP.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2CAB.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2LHA.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2ARJ.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2TNEF.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2LZ.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2AMG.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2TAR.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2RTF.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Symantec AntiVirus\Dec2Text.dll]  <Symantec Corporation><3.02.11.32>
    [C:\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll]  <Symantec Corporation><9.0.0.338>
[PID: 1000][C:\WINNT\system32\ctfmon.exe]  <Microsoft Corporation><1.00.2409.7 built by: Lab06_N>
    [C:\WINNT\system32\MZWBJ.IME]  <明泽五笔><4.00.950>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
[PID: 1008][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\WINNT\system32\MZWBJ.IME]  <明泽五笔><4.00.950>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
    [C:\WINNT\system32\igfxpph.dll]  <Intel Corporation><3,0,0,1918>
    [C:\WINNT\system32\hccutils.DLL]  <Intel Corporation><3,0,0,1918>
    [C:\WINNT\system32\igfxres.dll]  <Intel Corporation><3,0,0,1918>
    [C:\WINNT\system32\igfxsrvc.dll]  <Intel Corporation><3,0,0,1918>
    [C:\WINNT\system32\igfxdev.dll]  <Intel Corporation><3,0,0,1918>
[PID: 772][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 1124][C:\Program Files\Common Files\Symantec Shared\ccApp.exe]  <Symantec Corporation><2.2.0.577>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
    [C:\WINNT\system32\MZWBJ.IME]  <明泽五笔><4.00.950>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><2.2.0.577>
    [C:\Program Files\Symantec\LiveUpdate\ProductRegCom.DLL]  <Symantec Corporation><2.0.39.0>
    [C:\Program Files\Symantec\LiveUpdate\LuComServerPS.DLL]  <Symantec Corporation><2.0.39.0>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCALERT.DLL]  <Symantec Corporation><2.2.0.577>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCEMLPXY.DLL]  <Symantec Corporation><2.2.0.577>
    [C:\WINNT\system32\SYMREDIR.dll]  <Symantec Corporation><5.3.0.46>
    [C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll]  <Symantec Corporation><2.2.0.577>
    [C:\Program Files\Symantec AntiVirus\SavEmail.dll]  <Symantec Corporation><9.0.0.338>
    [C:\Program Files\Common Files\Symantec Shared\ccProSub.dll]  <Symantec Corporation><2.2.0.577>
[PID: 1180][C:\PROGRA~1\SYMANT~1\VPTray.exe]  <Symantec Corporation><9.0.0.338>
    [C:\Program Files\Symantec AntiVirus\SAVRT32.DLL]  <Symantec Corporation><9.3.0.28>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
    [C:\WINNT\system32\MZWBJ.IME]  <明泽五笔><4.00.950>
    [C:\Program Files\Symantec AntiVirus\Cliscan.dll]  <Symantec Corporation><9.0.0.338>
    [C:\PROGRA~1\SYMANT~1\NAVNTUTL.DLL]  <Symantec Corporation><9.0.0.338>
    [C:\Program Files\Symantec AntiVirus\Cliproxy.dll]  <Symantec Corporation><9.0.0.338>
[PID: 1152][D:\tools\查毒&木马\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINNT\systemKey.DLL]  <N/A><N/A>
    [C:\WINNT\system32\MZWBJ.IME]  <明泽五笔><4.00.950>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

有高手在吗?  帮我看看~~~~~~

[Microsoft SCSI Initiator / Microsoft SCSI Initiator]
<C:\WINNT\G_Server.exe><N/A>
[win32 / win32]
<C:\WINNT\G_Server1.23.exe><N/A>
[Windows Management Internet Drivers / Windows Internet Drivers]
<C:\WINNT\system32\system.exe><N/A>
[Windows Internet Drivers / Windows Management Drivers]
<C:\WINNT\system.exe><N/A>
安全模式...打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索Microsoft SCSI Initiator
win32
Windows Internet Drivers
Windows Management Drivers
删除...

删除
C:\WINNT\G_Server.exe
C:\WINNT\G_Server1.23.exe
C:\WINNT\system32\system.exe
C:\WINNT\system.exe
C:\WINNT\systemKey.DLL

嗯谢谢啦~~~
照你说的去删了~~
不过没找到有C:\WINNT\system32\system.exe这个文件啊...
还有在WINNT下有个system.dll的文件,这个要不要删?