现在可以说可能是瑞星的一个BUG,12月29日升级前的误报,目前升级到1月4日就不再有了
已经解决了。升级到1月4日新版本后，就不再报有了
谢谢各位
各位老大:本人不知道何时中了灰鸽子病毒.按照本论坛上的精华指引操作，也没能把病毒驱除,用了很多工具软件都不行.
本人感到疑惑，谁能提供帮助?
利用HIJACKTHIS扫描,看不出有可疑的内容
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 8:38:13, 日期 2006-12-30
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AhnLab\Smart Update Utility\AhnSDsv.exe
C:\Program Files\AhnLab\AhnLab SpyZero 2.0\AszMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Rising\AntiSpyware\runiep.exe
C:\Program Files\AhnLab\AhnLab SpyZero 2.0\AszTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\software\EWIDO3.5专业查杀木马\EWIDO3.5\ewido.exe
E:\software\EWIDO3.5专业查杀木马\EWIDO3.5\SecuritySuite.exe
C:\mySingle\Component\EpTray.exe
C:\Program Files\mySingle\messenger\messenger.exe
C:\Program Files\mySingle\messenger\myMailMonitor.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
E:\software\灰鸽子木马专杀\HijackThis 1.99.0\HijackThis1991汉化版\HijackThis1991zww.exe
O1 - Hosts: 109.10.1.17 bjdccs
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [AHNSD] "C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe"
O4 - 启动项HKLM\\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: desktop.ini
O4 - Global Startup: desktop.ini
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O15 - “受信任的站点”中添加项: *.samsung-emp.com
O15 - “受信任的站点”中添加项: *.samsung.net
O15 - “受信任的站点”中添加项: *.samsunggsbn.com
O15 - “受信任的站点”中添加项: *.samsungwireless.com
O16 - DPF: {00B4EB57-5F54-4A6A-BC1A-DE9ABA26C0E2} (EPWrapsodyVersion Class) - http://drm.samsung.net/activex/EPDRM.fasoo.cab
O16 - DPF: {011605F4-3A7F-44F8-828A-E2F3BC2BEC2E} (MyUpDown Control) - http://edms-ab.sec.samsung.net/edms/lib/myUpDown_U.cab
O16 - DPF: {03F49E0E-C43A-4037-BBD6-D681E998A08E} (CodeAx Class) - http://sso.sec.samsung.net/cabfiles/CM_CodeAx.cab
O16 - DPF: {1B954045-CB17-46CF-A596-BC59E7861D79} (mySingle.ClsLocal) - http://www.samsung.net/cabs/localmailfolder/mySingle_XPSP2.CAB
O16 - DPF: {2207EDAD-5731-4CCD-B79B-E489022E47AF} (GSBN.CHINA) - http://www.samsunggsbn.com/PSI3/China/Cab/GSBN_CHINA.CAB
O16 - DPF: {223216F6-B9FE-406D-9ED6-143FCE3A07B8} (MxLogicalTRU Class) - http://eofficech.sec.samsung.net/eoffice3/gauce/MxLogicalTRU.cab
O16 - DPF: {2F98EA90-EAE1-4AB5-AE89-DA073D824589} (MxBinderU Class) - http://gcms.sec.samsung.net/comp/cabfiles/MxBinderU.cab
O16 - DPF: {2FF8F8B7-1B3F-4E5F-93B1-FEF1D703C0F4} (LocalTree.LocalXMLTree) - http://www.samsung.net/cabs/LocalFolder2004/Cab/mySingleLocal_U.cab
O16 - DPF: {34B5A473-9696-4F9A-9BA1-41B8185A9798} (EpFTP3 Control) - http://www.samsung.net/cabs/EpFTP3/EpFTP3_U.cab
O16 - DPF: {3D6C131D-AE95-4484-B2D0-275D4EC62DFD} (Enc Class) - http://109.10.1.88:7001/ghr/pdssghr.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl
Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {4C77B4AB-C802-4E0D-A763-4F6E9EE37118} (SRW711.SRW_711_C) - http://218.249.63.211:4000/REGISTER_O/SRW711.CAB
O16 - DPF: {52DF16E3-6C4F-4B22-8BAF-09263E463B48} - http://zs.kingsoft.com/KOSInit.cab
O16 - DPF: {71E7ACA0-EF63-4055-9894-229B056E9C31} (MxGridU Class) - http://eofficech.sec.samsung.net/eoffice3/gauce/MxGridU.cab
O16 - DPF: {80017034-D4F8-410D-9B03-0E713C34CEAD} (Chart
Object) - http://www.samsunggsbn.com/chartfx62/download/ChartFX.ComIEClient.Core.cab
O16 - DPF: {859A7EB3-35E6-434B-A82B-08B4F8DDE1B6} (NamoWeCtl 6.0 for samsung_mysingle) - http://www.samsung.net/cabs/Namo/NamoWec.cab
O16 - DPF: {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} (163Uploader Control) - http://upload.photo.163.com/163Uploader.cab
O16 - DPF: {922DEB6A-364A-49C3-83EB-8B9FA3CE4B82} (NamoWeCtl 5.0 for Samsung_SIMS3) - http://simschina.sec.samsung.net/webeditor/NamoWec.cab
O16 - DPF: {9B3E5AA6-A9D6-46C4-99E4-B01AF6ABDD04} (IxTree Control) - http://edms-ab.sec.samsung.net/edms/lib/IxTree_R.CAB
O16 - DPF: {9F0AA341-1D10-4B18-B70B-6AA49CE7F5D6} (MxImageSetU Class) - http://eofficech.sec.samsung.net/eoffice3/gauce/MxImageSetU.cab
O16 - DPF: {A93FB56D-2F76-4DD7-8E38-9B1EB38C88A5} (SecureSession Class) - http://gcms.sec.samsung.net/comp/cabfiles/SecuiSECIE_eng.cab
O16 - DPF: {AF989B7C-8AC3-40BC-B749-EB335BDFD190} (MxDataSetU Class) - http://eofficech.sec.samsung.net/eoffice3/gauce/MxDataSetU.cab
O16 - DPF: {BB4533A0-85E0-4657-9BF2-E8E7B100D47E} (MxComboU Class) - http://gcms.sec.samsung.net/comp/cabfiles/MxComboU.cab
O16 - DPF: {C63E3330-049F-4C31-B47E-425C84A5A725} (EpAdm2 Control) - http://www.samsung.net/cabs/Tray/EpAdm2.cab
O16 - DPF: {D7779973-9954-464E-9708-DA774CA50E13} (MxMaskEditU Class) - http://gcms.sec.samsung.net/comp/cabfiles/MxMaskEditU.cab
O16 - DPF: {D7B715F5-F1E1-4904-93A6-1B53E07221A3} (SRW840.SRW_840_C) - http://218.249.63.211:4000/REGISTER_O/SRW840.CAB
O16 - DPF: {DE6ABA6A-095B-43E3-BEBB-879868DC5C8A} (SSLinks Control) - http://www.samsung.net/cabs/messenger/SSLinks.cab
O16 - DPF: {DF1AD5D9-977A-4A1F-9392-2AFFCCE6211F} (IxSheet Control) - http://edms-ab.sec.samsung.net/edms/lib/IxSheet_U.cab
O16 - DPF: {E1D1DACA-5BA2-4376-89AD-3A213B916779} (IBLeaders IBSheet For Unicode Control) - http://109.10.1.88:7001/ghr/common/sheet/IBSheet4Unicode.CAB
O16 - DPF: {E463DD62-1D07-425E-B82A-539FBA2F4162} (GSBN_Updater.UserControl1) - http://www.samsunggsbn.com/PSI3/Cab/GSBN_Updater.CAB
O16 - DPF: {F3E92562-1B4D-4BFA-B2D4-E9BCABE3B6A3} (Iesign Control) - https://ebanks.spdb.com.cn/per/gb/js/iesign.ocx
O16 - DPF: {F80FFA1F-348B-4FA4-B1E6-BC63A82090A0} (SRL101.SRL_101_C) - http://218.249.63.211:4000/SRL101.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{B84A5880-EDDA-4259-8113-69DC9B5511DE}: NameServer = 203.241.132.34,203.241.132.85
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: AhnLab Task Scheduler - AhnLab, Inc. - C:\Program Files\AhnLab\Smart Update Utility\AhnSDsv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: SpyZero_Monitor - AhnLab, Inc. - C:\Program Files\AhnLab\AhnLab SpyZero 2.0\AszMon.exe
问题在于
1.如果开机后不打开IE浏览器,瑞星查不到有病毒
2.只要一打开IE浏览器，瑞星就可以查获内存有驻留灰鸽子病毒，清除的同时IE浏览器被关掉.如果再打开IE浏览器再查杀还有,见图
是c:\Program Files\Internet Explorer\IEXPLORE.EXE报鸽子
