瑞星卡卡安全论坛

病毒名称Backdoor.Gpigeon.ejj 删除后重新启动机器后又出现，反复如此，杀不掉。求助

路径c:\winnt\system32\severs.exe

哪位帮忙

c:\winnt\system32\severs.exe
找到 QQ289039676 传给我

再 贴上  hijackthis日志

先请看日志，那个文件要再启动后才能找到，中午给您可以吗

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\llssrv.exe
C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINWEB~1\EMSVR.EXE
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\rdpclip.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\program files\rising\rfw\rfwmain.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINNT\msagent\AgentSvr.exe
C:\WINNT\system32\logon.scr
D:\本机应用程序\HijackThis V1.99.1 汉化版\HijackThis.exe

O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "c:\program files\rising\rfw\rfwmain.exe" -startup
O4 - HKLM\..\Run: [WebEasyMail] D:\WINWEB~1\easymail.exe -src
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - Global Startup: 服务管理器.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158066815859
O17 - HKLM\System\CCS\Services\Tcpip\..\{58F92F53-6D13-4354-8115-9EAA3C0B60A5}: NameServer = 202.99.192.66,202.99.192.68
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Microsoft_System_Server (MicrosoftSystemServers) - Unknown owner - C:\WINNT\system32\Severs.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: WinWebMail Server - Ma Jian - D:\WINWEB~1\EMSVR.EXE

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Microsoft_System_Server (MicrosoftSystemServers) - Unknown owner - C:\WINNT\system32\Severs.exe


是什么？

O23 - Service: Microsoft_System_Server (MicrosoftSystemServers) - Unknown owner - C:\WINNT\system32\Severs.exe
是 灰鸽子


C:\WINNT\system32\Severs.exe


现在 给我吧  QQ289039676

请接收，感谢
请帮我分析一下如何彻底删除
再帮我分析一下日志，看看还有其他潜在危害没有

请问taylor05771
搞的怎么样了？

晕了，我恐怕中的也是这个

请求帮助了

怎么中这个灰鸽子的是不是开网页中到的，请你告诉我一下，可以让我预防着点，要是我中到的话我就没辙了~又要系统重装，在这里说声谢谢了~

我中的病毒叫:Backdoor.Gpigeon.uql
我也是用瑞星的最新正版杀了N次,可是问题是,杀完重起,就又有了，还是这个!!!怎么解决啊,帮忙啊,头大了!!!

O23 - Service: Microsoft_System_Server (MicrosoftSystemServers) - Unknown owner - C:\WINNT\system32\Severs.exe
灰鸽子..安全模式...打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索 MicrosoftSystemServers 删除...
删除
C:\WINNT\system32\Severs.exe

非常感谢斑竹回复，按照您提示的方法问题解决了
谢谢！