为什么瑞星不在自己的产品里加入类似的东西啊！为何那么麻烦买正版软件图的就是方便啊！再说有几个人像楼主一样精通电脑！

先收下再说

请教斑竹，为什么我每次开机在显示屏的右下角都会出现“发现winl.exe＞＞C:\winl.exe-＞Backdoor.RCMD.c 病毒已清除”，是不是我的系统里有病毒了啊？我该如何？敬请指教！多谢了！

谢谢楼主
鸽子已经杀掉了
我也把那个SSM装了
但是每次开机都有提示说：“SSM会话没有完成”但我已经按帖子首页的设置选了，只是在“常规”选项中新版本有点不一样
请问是什么意思啊？
装的是官方多国语言版

偶是菜鸟，看不懂日志，请版主帮忙看看，有问题没有。谢谢！！

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      15:06:26, 日期 2005-12-13
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Unable to get Internet Explorer version!

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\KV2005\KVSrvXP.exe
C:\Program Files\KV2005\kvwsc.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
C:\Program Files\KV2005\KVMonXP.kxp
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\System Safety Monitor\SysSafe.exe
C:\Program Files\KV2005\TrojDie.kxp
C:\Program Files\KV2005\KRegEx.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\system32\taskmgr.exe
E:\TTPlayer\TTPlayer\TTPlayer.exe
E:\Program Files\Tencent\qq\QQ.exe
E:\maxthoncn\Maxthon.exe
G:\木马杀客\冰刃\HijackThis1[1].99.1\HijackThis1991zww.exe

O1 - Hosts: 202.108.22.119 www.hao123.com
O1 - Hosts: 207.46.199.30 www.microsoft.com
O1 - Hosts: 207.46.199.30 www.microsoft.com
O1 - Hosts: 207.46.199.30 www.microsoft.com
O1 - Hosts: 207.46.199.30 www.microsoft.com
O1 - Hosts: 202.105.31.72 www.qqreport.com
O1 - Hosts: 220.201.193.5 www.cnhacks.com
O1 - Hosts: 211.97.168.175 ruyi.onlinedown.net
O1 - Hosts: 210.52.216.215 bbs.1098.com.cn
O1 - Hosts: 207.46.199.30 www.microsoft.com
O1 - Hosts: 207.46.199.30 www.microsoft.com
O1 - Hosts: 207.46.199.30 www.microsoft.com
O1 - Hosts: 207.46.199.30 www.microsoft.com
O1 - Hosts: 222.208.168.135 www.qsch.net
O1 - Hosts: 209.120.239.16 www.tt6y.com
O1 - Hosts: 205.209.156.226 bbs.morok.net
O1 - Hosts: 65.54.153.254 spaces.msn.com
O1 - Hosts: 64.66.163.251 bbs1.sejie.com
O1 - Hosts: 219.153.14.16 zykj.yao68.cn
O1 - Hosts: 61.139.126.19 www.congl.com
O1 - Hosts: 222.36.45.211 www.li20.net
O1 - Hosts: 210.52.216.215 bbs.1098.com.cn
O1 - Hosts: 218.204.251.12 bbs.macd.cn
O1 - Hosts: 218.1.72.118 bbs.gw.com.cn
O1 - Hosts: 211.144.143.139 www.xtstock.com
O1 - Hosts: 221.229.127.201 www.seawindonline.com
O1 - Hosts: 61.151.248.110 www.mfzq.com.cn
O1 - Hosts: 61.151.248.110 www.mfzq.com.cn
O1 - Hosts: 61.129.75.76 www.jyzqlt.cn
O1 - Hosts: 219.153.18.165 www.cylzq.net
O1 - Hosts: 61.131.96.37 bbs.fjfox.com
O1 - Hosts: 61.139.76.81 bbs.tieren.net
O1 - Hosts: 61.139.76.81 www.tieren.net
O1 - Hosts: 222.36.44.67 www.88515808.com
O1 - Hosts: 61.152.116.116 scyj.stock.cnfol.com
O1 - Hosts: 61.154.127.78 bbs.pzz.cn
O1 - Hosts: 61.129.15.73 www.chinadforce.com
O1 - Hosts: 211.147.7.151 bbs.77169.com
O1 - Hosts: 218.28.167.142 hackbase.com
O1 - Hosts: 210.51.187.165 www.cnproxy.com
O1 - Hosts: 221.238.195.29 emuch.net
O1 - Hosts: 205.209.187.11 forum.e2002.com
O1 - Hosts: 218.202.107.82 www.itzero.com
O1 - Hosts: 61.152.167.118 www.cfanclub.net
O1 - Hosts: 61.157.96.27 www.dofile.com
O1 - Hosts: 207.46.199.30 www.microsoft.com
O1 - Hosts: 219.142.168.67 www.kaspersky.com.cn
O1 - Hosts: 61.129.47.67 www.eimhe.com
O1 - Hosts: 219.142.168.67 www.kaspersky.com.cn
O1 - Hosts: 221.14.150.132 www2.3800cc.com
O1 - Hosts: 211.157.102.232 www.hacker.com.cn
O1 - Hosts: 61.166.33.214 www.netxeyes.com
O1 - Hosts: 219.238.233.252 forum.ikaka.com
O1 - Hosts: 221.10.254.87 www.friendin.net
O1 - Hosts: 211.99.206.102 bbs.jxue.com
O1 - Hosts: 61.135.153.17 forum.cul.sina.com.cn
O1 - Hosts: 222.46.112.146 www.yijuy.com
O1 - Hosts: 218.200.152.3 lyc.2000y.net
O1 - Hosts: 61.172.196.125 www.i-part.com.cn
O1 - Hosts: 202.101.62.24 bbs.xyhc.com
O1 - Hosts: 58.241.71.9 photo.163.com
O1 - Hosts: 61.136.60.107 www.chinabbs.com
O1 - Hosts: 202.105.31.85 bbs.tcyg.net
O1 - Hosts: 210.51.2.132 www.mohappy.com
O1 - Hosts: 61.152.93.48 www.1000fr.com
O1 - Hosts: 202.108.45.151 g3a24.mail.163.com
O1 - Hosts: 202.101.62.24 bbs.xyhc.com
O1 - Hosts: 202.108.43.230 mail.sina.com.cn
O1 - Hosts: 211.99.206.102 bbs.jxue.com
O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\Program Files\KV2005\KvShell_1.dll
O3 - IE工具栏增项: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\Program Files\KV2005\KvShell_1.dll
O4 - 启动项HKLM\\Run: [Zone Labs Client] C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
O4 - 启动项HKLM\\Run: [KvMonXP] "C:\Program Files\KV2005\KVMonXP.kxp" /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SystemSafetyMonitor] C:\Program Files\System Safety Monitor\SysSafe.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\kvwspxp.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\kvwspxp.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\kvwspxp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF2BE1CB-A188-4FF2-A7F2-30A1C975C572}: NameServer = 202.98.0.68 202.98.1.11
O23 - NT 服务: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - NT 服务: KVSrvXP - JiangMin New Tech Ltd. - C:\PROGRA~1\KV2005\KVSrvXP.exe
O23 - NT 服务: KVWSC - Jiangmin Co.Ltd - C:\Program Files\KV2005\kvwsc.exe
O23 - NT 服务: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

我上次中灰鸽子是在注册表和系统中删除相关的文件，然后再使用系统还原解决的。

ddddddddd

还是不错的

引用:

【一簔烟雨的贴子】偶是菜鸟，看不懂日志，请版主帮忙看看，有问题没有。谢谢！！ ...........................

C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
这个是什么东西啊~~~
修复所有的01项，及06项
其它的没有发现什么问题，，
关闭所有的IE页面~
清空临时文件夹
清空临时文件夹的方法：
IE》属性》删除文件（包括脱机文件）》确定
还有，，，你的系统补丁是否打全，，，
另，还有个小建议，，（是针对IE的安全设置的，，IE》属性》安全》禁止下载Activex控件，禁止Activex控件自动提示，禁用二进制和脚本行为等，，，这些你可以自己看，，，不行可以再调回来，，）

你好,我的机子也中了这木马,瑞星查杀出来全称是Backdoor.Gpigeon.uju可是重启后,进入QQ第一次打开好友就会自动发送这病毒,还有网页首页被固定,下面是我的日志,请帮忙看看,有没有病毒或可疑文件,有的话怎么查杀,谢谢!Logfile of HijackThis v1.99.1
Scan saved at 10:53:17, on 2005-12-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system\czujllchh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\TT\TTraveler.exe
D:\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {6BDE1669-B490-48E3-B668-456314F2D6C3} - (no file)
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\flashget\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\flashget\fgiebar.dll
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [czujllchh.exe] C:\WINDOWS\system\czujllchh.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Google 搜索(&G) - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\flashget\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\flashget\jc_all.htm
O8 - Extra context menu item: 反向链接 - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 百度-搜索MP3 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度-搜索图片 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度-搜索新闻 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 百度-搜索歌词 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDULYRIC.HTM
O8 - Extra context menu item: 百度-搜索网页 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度-搜索贴吧 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUPOST.HTM
O8 - Extra context menu item: 百度-词典搜索 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_DIC.HTM
O8 - Extra context menu item: 类似网页 - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: 缓存的网页快照 - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: 翻译英文字词(&T) - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\浩方对战平台\GameClient.exe
O9 - Extra button: 下载管理 - {3DB9F45E-AA74-4373-A466-C18A9F1C500D} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 下载管理 - {3DB9F45E-AA74-4373-A466-C18A9F1C500D} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: 易趣购物 - {BE9C13C3-9E46-4db1-BC05-BD8DA44599F2} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-195?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {BE9C13C3-9E46-4db1-BC05-BD8DA44599F2} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-195?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\flashget\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\flashget\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O16 - DPF: {DDA166FA-B3EA-4A3B-8EE2-4F552CDEEE81} (KATScan Control) - http://211.152.52.102/duba/antitrojan/update/OCX/KATScan.CAB
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe