瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 鄙视:Backdoor.Gpigeon.csf..来帮偶杀杀.

1   1  /  1  页   跳转页

鄙视:Backdoor.Gpigeon.csf..来帮偶杀杀.

收藏
3212312
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2006-06-25
  • 来自:
发表于： 2006-07-06 17:23 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

鄙视:Backdoor.Gpigeon.csf..来帮偶杀杀.

快来帮偶.大哥大婶们

2006-07-06,17:07:50

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    正在运行的进程（包括进程模块信息）


启动项目
注册表
启动文件夹
服务

==================================
浏览器加载项
正在运行的进程
[PID: 436][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 500][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 524][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 568][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 580][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 724][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 768][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 808][E:\Rav\Rising\Rav\CCenter.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 840][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 880][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 924][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 960][E:\Rav\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 26>
    [E:\Rav\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [E:\Rav\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [E:\Rav\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [E:\Rav\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [E:\Rav\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [E:\Rav\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [E:\Rav\Rising\Rav\HOOKSYS.dll]  <Rising><18, 1, 0, 9>
    [E:\Rav\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [E:\Rav\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [E:\Rav\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [E:\Rav\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [E:\Rav\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 1>
    [E:\Rav\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [E:\Rav\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [E:\Rav\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [E:\Rav\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [E:\Rav\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [E:\Rav\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [E:\Rav\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [E:\Rav\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [E:\Rav\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [E:\Rav\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [E:\Rav\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [E:\Rav\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
    [E:\Rav\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17>
    [E:\Rav\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [E:\Rav\Rising\Rav\RsStore.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [E:\Rav\Rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1152][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1340][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1388][E:\Rav\Rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [E:\Rav\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [E:\Rav\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1392][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 1816][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [c:\program files\google\googletoolbar1.dll]  <Google Inc.><3, 0, 131, 0>
    [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]  <Thunder Networking Technologies,LTD><5, 0, 0, 2>
    [E:\Rav\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
    [E:\Rav\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\PROGRA~1\MMSASS~1\Mmsass~1.dll]  <><1, 2, 0, 2>
[PID: 316][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 460][C:\WINDOWS\SOUNDMAN.EXE]  <Realtek Semiconductor Corp.><5, 1, 0, 48>
[PID: 488][E:\Rav\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [E:\Rav\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [E:\Rav\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [E:\Rav\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [E:\Rav\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 504][E:\Rav\Rising\Rav\Ravmon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 28>
    [E:\Rav\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
    [E:\Rav\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [E:\Rav\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [E:\Rav\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [E:\Rav\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [E:\Rav\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [E:\Rav\Rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 860][C:\WINDOWS\vsnpstd3.exe]  <><1, 0, 2, 2>
[PID: 1052][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3100][E:\Program Files\Tencent\TT\TTraveler.exe]  <腾讯公司><3.0.0.250>
    [E:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  <腾讯公司><1, 1, 0, 5>
    [E:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll]  <><1, 0, 0, 3>
    [E:\Program Files\Tencent\TT\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
    [E:\Rav\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
[PID: 3700][F:\BitComet\rules\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
Winsock 提供者

==================================
最后编辑2006-07-06 18:44:55
分享到：
gototop
 
taylor05771
头像
社区嘉宾
  • 帖子:7232
  • 注册: 2003-12-24
  • 来自:
发表于： 2006-07-06 17:42 | 短消息 资料
字号： 小 中 大 2楼

hijackthis 日志
gototop
 
3212312
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2006-06-25
  • 来自:
发表于： 2006-07-06 17:47 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

什么东东?
gototop
 
3212312
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2006-06-25
  • 来自:
发表于： 2006-07-06 17:48 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

Logfile of HijackThis v1.99.1
Scan saved at 17:39:03, on 2006-7-6
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
E:\Rav\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
E:\Rav\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
E:\Rav\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
E:\Rav\Rising\Rav\RavTask.exe
E:\Rav\Rising\Rav\Ravmon.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Tencent\TT\TTraveler.exe
C:\WINDOWS\system32\conime.exe
F:\BitComet\rules\ha_hijackthis_1991\HijackThis.exe

R3 - URLSearchHook: (no name) - {C28DDEA9-FBAB-4EC8-9741-7236816EDB7C} - C:\WINDOWS\system32\Xtza.dll (file missing)
R3 - URLSearchHook: (no name) - {07C1B0FF-BED8-4D7C-A771-48A8EAF76929} - C:\WINDOWS\system32\Zaif.dll (file missing)
R3 - URLSearchHook: (no name) - {2FBC7AE0-A1DC-4342-BDD6-BCC99ACF5CD1} - C:\WINDOWS\system32\Zfwhex.dll (file missing)
R3 - URLSearchHook: (no name) - {E9D5FCF3-2FDC-4844-AB0F-C64823A744B7} - C:\WINDOWS\system32\Bdfqv.dll (file missing)
R3 - URLSearchHook: (no name) - {C17D45EC-23D7-4A73-81DB-DCA9821AEB3D} - C:\WINDOWS\system32\Ualnoq.dll (file missing)
R3 - URLSearchHook: (no name) - {5C61E1FA-37C4-4C1E-8BAA-8738569568B7} - C:\WINDOWS\system32\Inqvv.dll (file missing)
R3 - URLSearchHook: (no name) - {695610A7-9A29-4B2B-9401-85976C1B9A7C} - C:\WINDOWS\system32\Svqyl.dll (file missing)
R3 - URLSearchHook: (no name) - {40F8447A-6DC8-45EA-A99A-54A73FCE05B3} - C:\WINDOWS\system32\Zbzsng.dll (file missing)
R3 - URLSearchHook: (no name) - {D495CDE5-E5A1-4DD2-BADC-E2974D823B1A} - C:\WINDOWS\system32\Jbczaq.dll (file missing)
R3 - URLSearchHook: (no name) - {7340B19A-A5AB-4FD7-B599-CBA964B7522E} - C:\WINDOWS\system32\Yciwsd.dll (file missing)
R3 - URLSearchHook: (no name) - {43670F2F-B12B-4036-9F3E-F3B2FAC3D509} - C:\WINDOWS\system32\Ilthal.dll (file missing)
F2 - REG:system.ini: UserInit=userinit.exe,
O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RavTask] "E:\Rav\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [StormCodec_Helper] ; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [Thunder] "C:\Program Files\Thunder Network\Thunder\Thunder.exe" /s
O4 - HKLM\..\Run: [helper.dll] ; C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002A] ;
O4 - HKLM\..\Run: [PHIME2002ASync] ;
O4 - HKLM\..\Run: [stup.exe] ;
O4 - HKLM\..\Run: [yassistse] ;
O4 - HKLM\..\Run: [YLive.exe] ;
O4 - HKLM\..\RunOnce: [Super Rabbit Winspeed] "F:\Program Files\Super Rabbit\MagicSet\winspeed.exe" /autokill:54,35,14
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\Program Files\QQ2005\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\Program Files\QQ2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\Program Files\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\Program Files\QQ2005\SendMMS.htm
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: 易趣购物 - {DE607145-AC19-425e-865A-5D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607145-AC19-425e-865A-5D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab?da8058c66c08fbf6b7765fb0f3159a55044a4bf4d84035dec0a09acb6467328be4fe4bc84d7bf66a7ac19bce14966dbe7f291de8076653b0508a8f0ff65fc8a22502fdad81df4a8b:278a3d34c2078d9522cc73d7fb3f8d5b
O17 - HKLM\System\CCS\Services\Tcpip\..\{C6D2BBA8-65EE-46CC-81EA-C3B12B0E9BDE}: NameServer = 202.100.192.68 202.100.199.8
O23 - Service: Rising Personal Firewall - Unknown owner - C:\WINDOWS\uninstrs.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Rav\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Rav\Rising\Rav\Ravmond.exe
gototop
 
3212312
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2006-06-25
  • 来自:
发表于： 2006-07-06 17:50 | 只看楼主 短消息 资料
字号： 小 中 大 5楼

网警大哥咋样了撒.
gototop
 
3212312
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2006-06-25
  • 来自:
发表于： 2006-07-06 18:41 | 只看楼主 短消息 资料
字号： 小 中 大 6楼

怎么都不回贴的啊???
gototop
 
3212312
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2006-06-25
  • 来自:
发表于： 2006-07-06 18:52 | 只看楼主 短消息 资料
字号： 小 中 大 7楼

急啊
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT