瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 中毒了Backdoor.Gpigeon.ynj,老是杀不掉请教如何杀毒

1   1  /  1  页   跳转页

中毒了Backdoor.Gpigeon.ynj,老是杀不掉请教如何杀毒

收藏
喝下你的毒药
头像
拙长孩提狮
  • 帖子:61
  • 注册: 2003-06-14
  • 来自:
发表于： 2006-05-07 09:12 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

中毒了Backdoor.Gpigeon.ynj,老是杀不掉请教如何杀毒

瑞星老是查到IE中了个Backdoor.Gpigeon.ynj病毒.(本人理解为灰鸽子),以下是用HijackThis_815汉化版扫描后的日志 V1.99.1

保存于      9:04:41, 日期 2006-5-7
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
d:\Program Files\rising\Rav\CCenter.exe
D:\WINDOWS\System32\svchost.exe
d:\Program Files\rising\Rav\Ravmond.exe
d:\program files\rising\rfw\rfwsrv.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
d:\Program Files\rising\Rav\RavStub.exe
d:\program files\rising\rfw\RfwMain.exe
D:\WINDOWS\system32\CTHELPER.EXE
D:\Program Files\WinPower2000\AgentManager.exe
D:\Program Files\rising\Rav\RavTask.exe
D:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\rising\Rav\Ravmon.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\Program Files\Executive Software\Diskeeper\DkService.exe
D:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\WinPower2000\AgentNT.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
D:\WINDOWS\System32\svchost.exe
E:\games\9you\劲乐团\OTwo.exe
E:\games\9you\劲乐团\OTwo.exe
D:\Program Files\Super Rabbit\MagicSet\winspeed.exe
C:\Downloads\病毒\4842302005817230232\HijackThis1991zww.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll (file missing)
O3 - IE工具栏增项: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - D:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll
O3 - IE工具栏增项: MSN 工具栏 - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Toolbar\01.01.2607.0\zh-cn\msntb.dll
O3 - IE工具栏增项: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - D:\Program Files\BitComet\BitCometBar\BitCometBar0.2.dll
O3 - IE工具栏增项: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [CTHelper] CTHELPER.EXE
O4 - 启动项HKLM\\Run: [Jet Detection] "D:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - 启动项HKLM\\Run: [Agent Manager] D:\Program Files\WinPower2000\AgentManager.exe
O4 - 启动项HKLM\\Run: [Logitech Utility] Logi_MwX.Exe
O4 - 启动项HKLM\\Run: [DiskeeperSystray] "D:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - 启动项HKLM\\Run: [RfwMain] "d:\Program Files\rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [RavTask] "d:\Program Files\rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [nwiz] ; nwiz.exe /install
O4 - 启动项HKLM\\Run: [NvMediaCenter] ; RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - 启动项HKLM\\Run: [IMONTRAY] ; D:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\RunOnce: [RavStub] "d:\Program Files\rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O8 - IE右键菜单中的新增项目: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - D:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - D:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Excel(&x) - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\games\浩方对战平台\GameClient.exe
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {74447F9C-5691-4A9A-8BE4-564092E40B03} (VnetAnprIns Class) - http://plugin.chinavnet.com/VnetPluginIns.CAB
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: apihookdll.dll
O23 - NT 服务: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\System32\CTsvcCDA.exe
O23 - NT 服务: Diskeeper - Executive Software International, Inc. - D:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - NT 服务: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - D:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exe
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - NT 服务: Intel(R) Active Monitor (imonNT) - Intel Corp. - D:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Program Files\rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\Program Files\rising\Rav\Ravmond.exe
O23 - NT 服务: System Mageter - Unknown owner - D:\Program Files\Common Files\Consu.exe
O23 - NT 服务: WinPower2000 - SANTAK Corp - D:\Program Files\WinPower2000\AgentNT.exe
请高手帮看看我到地是中了毒吗?如何才能彻底杀毒.不胜感激...
最后编辑2006-05-07 12:43:07
分享到：
gototop
 
喝下你的毒药
头像
拙长孩提狮
  • 帖子:61
  • 注册: 2003-06-14
  • 来自:
发表于： 2006-05-07 12:39 | 只看楼主 短消息 资料
字号： 小 中 大 2楼

求教啊,不胜感激啊
gototop
 
事了拂衣去
头像
拙长孩提狮
  • 帖子:97
  • 注册: 2005-10-11
  • 来自:
发表于： 2006-05-07 12:43 | 短消息 资料
字号： 小 中 大 3楼

O23 - NT 服务: System Mageter - Unknown owner - D:\Program Files\Common Files\Consu.exe
应该是鸽子吧,
http://forum.ikaka.com/topic.asp?board=28&artid=7713905有答案
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT