我电脑中了Backdoor.Gpigeon.5.cd,现在该怎么办呀?中的文件是C:\Progeam File\Internet Explrer\IXPLORE.EXE.各位大虾们,该怎么办呀

引用:

【johnsonwang的贴子】我电脑中了Backdoor.Gpigeon.5.cd,现在该怎么办呀?中的文件是C:\Progeam File\Internet Explrer\IXPLORE.EXE.各位大虾们,该怎么办呀 ...........................

http://forum.ikaka.com/topic.asp?board=28&artid=6202404

IEXPLORE.EXE>>C:\Program Files\Internet Explorer\IEXPLORE.EXE ->Backdoor.Gpigeon.5.cd


我也是提示这样哦....重启之后木马就还原了....

http://forum.ikaka.com/topic.asp?board=28&artid=6202404
我看了....但是里面的说在注册表那里删的那些...我里面没有的..

扫描一份HJ日志来看！~

Logfile of HijackThis v1.99.1
Scan saved at 21:09:55, on 2006-1-2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
D:\瑞星\CCenter.exe
C:\windows\System32\svchost.exe
D:\瑞星\Ravmond.exe
d:\瑞星防火墙\rfwsrv.exe
C:\windows\system32\spoolsv.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\Explorer.EXE
D:\瑞星\RavStub.exe
d:\瑞星防火墙\RfwMain.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\windows\Mixer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\瑞星\RavTask.exe
D:\瑞星\Ravmon.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
E:\网络下载\文件\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: 超级兔子上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\超级兔子\HaokanBar.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - D:\金山快译\IEBand.dll
O3 - Toolbar: 超级兔子上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\超级兔子\HaokanBar.dll
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [RfwMain] "D:\瑞星防火墙\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [CertificateRegistration] SafeSignCertReg.exe
O4 - HKLM\..\Run: [RavTask] "D:\瑞星\RavTask.exe" -system
O4 - HKLM\..\Run: [Super Rabbit SRRestore] D:\超级兔子\srrest.exe /autosave
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - D:\讯雷\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\讯雷\getAllurl.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O16 - DPF: {038318E8-0C2D-4DF5-A7AF-B4FB373F501E} (HBHelper.HBActivex) - http://download.henbang.net/download/updatelist/helper.cab
O16 - DPF: {0EB487C8-E9AC-43A6-8C4C-083999B0622F} (InfosecCertInstall Class) - https://mybank.icbc.com.cn/icbc/perbank/certInStall.dll
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://bbsky.wuhan.net.cn/plugin/PowerPlr.ocx
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} (InfoSecNetSign Class) - https://mybank.icbc.com.cn/icbc/NetSign.dll
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {DA215190-98B2-47DE-AE24-DA95481DFFBA} (AxUSBKey Class) - https://mybank.icbc.com.cn/icbc/perbank/AxUSBKey.CAB
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://ps.itv.mop.com/dn/files/pCastCtl_1.0.0.75_20051031.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD081938-1466-4892-9035-01256294569D}: NameServer = 202.103.24.68 202.103.0.68
O18 - Protocol: mbox - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\瑞星防火墙\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\瑞星\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\瑞星\Ravmond.exe
O23 - Service: System_Server - Unknown owner - C:\windows\System_Server.exe

O23 - Service: System_Server - Unknown owner - C:\windows\System_Server.exe，，，处理方法见

处理方法见http://forum.ikaka.com/topic.asp?board=28&artid=7625029

这个一眼就看出是灰鸽子，呵呵！我知道怎么清除，不过我不想说！毕竟行有行内的规则！

难道你就是养鸽子的那个~~~~~????

好象是嘛！~~