中了Backdoor.Gpigeon.uql，瑞星2006删除不掉，请各位帮忙看看日志，哪一个是病毒啊？


Logfile of HijackThis v1.99.0
Scan saved at 17:30:28, on 2006-3-9
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Rising\Rav\Ravmond.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\Program Files\Rising\Rav\RavStub.exe
d:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Conexant\SmartAudio\SmartAudio.exe
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\temp\u3spwd.exe
C:\Program Files\Huawei Technologies\Huawei Dialer V1.0\Dialer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
H:\安装程序备份\网络安全\HijackThis\HijackThis.exe

O2 - BHO: Router Layer - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINDOWS\System32\aclayer.dll (file missing)
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\Program Files\Baidu\Bar\BaiduBar.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Program Files\Baidu\Bar\BaiduBar.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SmartAudio] C:\Program Files\Conexant\SmartAudio\SmartAudio.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe
O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [MoveSearch] C:\Program Files\wsearch\Search.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe
O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{215E7CD2-B990-4CDB-92E6-B10E85733F17}: NameServer = 220.192.0.130 220.192.8.58
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Removable Stoarge - Unknown - C:\WINDOWS\twnuk_32.exe
O23 - Service: Rising Personal Firewall Service - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\Ravmond.exe

O23 - Service: Removable Stoarge - Unknown - C:\WINDOWS\twnuk_32.exe

我感觉是上面的那一个，可是注册表里又找不到这个服务项，这是怎么回事啊？

哪位高人指点一下啊，不胜感激！

C:\WINDOWS\temp\u3spwd.exe
终止这个进程！
O23 - Service: Removable Stoarge - Unknown - C:\WINDOWS\twnuk_32.exe

灰鸽子！

O2 - BHO: Router Layer - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINDOWS\System32\aclayer.dll (file missing)
修复这一项！

如果使用了系统还原，请先关闭。
请关闭所有浏览器窗口和文件夹窗口, 在安全摸试下修复上面几项)（如果你清楚某项是安全的，可以不处理）
，将隐藏的文件不隐藏。找到下面几项C:\WINDOWS\temp\u3spwd.exe
C:\WINDOWS\System32\aclayer.dll
C:\WINDOWS\twnuk_32.exe

把它们删除

O23 - Service: Removable Stoarge - Unknown - C:\WINDOWS\twnuk_32.exe

灰鸽子！
查杀灰鸽子的方法在这里有解答！http://forum.ikaka.com/topic.asp?board=28&artid=6372316          http://forum.ikaka.com/topic.asp?board=28&artid=7107792O23 - NT

O4 - HKLM\..\Run: [MoveSearch] C:\Program Files\wsearch\Search.exe
这是你装的网络猪！卸载为好！

谢谢，谢谢，多谢了。

先下线试试看。

但是注册表中没有叫 Removable Stoarge的服务项啊，我应该删除哪个服务项啊？

结束以下进程：
C:\WINDOWS\temp\u3spwd.exe
修复以下项目：
O2 - BHO: Router Layer - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINDOWS\System32\aclayer.dll (file missing)
O4 - HKLM\..\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe
O4 - HKCU\..\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe

O23 - Service: Removable Stoarge - Unknown - C:\WINDOWS\twnuk_32.exe
四楼这位仁兄有介绍！！

O4 - HKLM\..\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe
---青娱乐---————垃圾（流氓）软件{个人见解}
仅供参考  :)