我不小心中了 backdoor.Gpigeon.wfv 哪位大哥教下怎么除 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛我不小心中了 backdoor.Gpigeon.wfv 哪位大哥教下怎么除

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

我不小心中了 backdoor.Gpigeon.wfv 哪位大哥教下怎么除

天天乐逍遥初生襁褓狮帖子:5 注册: 2006-07-16 来自:	发表于： 2006-07-16 21:13 \| 只看楼主短消息资料字号：小中大 1楼我不小心中了 backdoor.Gpigeon.wfv 哪位大哥教下怎么除这是日志 Logfile of HijackThis v1.99.1 Scan saved at 20:50:57, on 2006-7-16 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\Program Files\Rising\Rav\Ravmond.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\System32\SCardSvr.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\Program Files\Rising\Rav\RavStub.exe C:\WINNT\Explorer.EXE C:\WINNT\SOUNDMAN.EXE C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Rising\Rav\Ravmon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\VnetClient1.6\VnetClient.exe D:\QQ\QQ.exe D:\QQ\TIMPlatform.exe D:\DownLoads\Superr\MagicSet.exe D:\DownLoads\Superr\srsearch.exe C:\WINNT\regedit.exe C:\Program Files\Rising\Rav\Rav.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\fzjsms1\LOCALS~1\Temp\Rar$EX02.011\HijackThis.exe F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v14.dll O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing) O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\barhelp24.0.dll O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: 天下搜索 - {56A7DC70-E102-4408-A34A-AE06FEF01586} - C:\WINNT\Downloaded Program Files\iebar23.0.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [RegNetPass] C:\WINNT\system32\regcsp.exe O4 - HKLM\..\Run: [gemstrmw] C:\WINNT\system32\gemstrmw.exe /r O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\新建文件夹\daemon.exe" -lang 1033 O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\QQ\AddToNetDisk.htm O8 - Extra context menu item: 使用KuGoo3下载(&K) - D:\Program Files\KuGoo3\KuGoo3DownX.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ\SendMMS.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: 易趣购物 - {DE607142-AC19-422e-868A-8D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing) O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607142-AC19-422e-868A-8D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing) O10 - Unknown file in Winsock LSP: c:\winnt\system32\quartz32.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\quartz32.dll O15 - Trusted Zone: http://www.icbc.com.cn O16 - DPF: {18F57D30-EF36-4C0E-9343-7BFA6DF79B4A} (XLink Class) - http://www.ycdy.com/swflash.CAB O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab O16 - DPF: {5932517A-3326-4439-A708-1C98EDB5C549} (Downloader Class) - http://eacs.eqifa.com/mop/iMopDl.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2EED1538-9B34-45C0-9D5A-53065E7FD365}: NameServer = 218.85.157.99 202.101.98.55 O17 - HKLM\System\CS1\Services\Tcpip\..\{2EED1538-9B34-45C0-9D5A-53065E7FD365}: NameServer = 218.85.157.99 202.101.98.55 O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe O23 - Service: Yast User Switching . - Unknown owner - C:\WINNT\MSN.exe 怎么删谢谢了 2006-07-17 03:22:53
天天乐逍遥初生襁褓狮帖子:5 注册: 2006-07-16 来自:	分享到：

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-07-16 21:26 \| 短消息资料字号：小中大 2楼开始→运行→输入services.msc，打开“服务”→查找 Yast User Switching .→双击→启动类型→禁止→停止→应用→确定。禁止Yast User Switching .这个服务请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931，下载，LSPFix.exe，WinsockXPFix这两个软件重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows 关闭所有浏览窗口以及一些不必要的程序运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复 O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\barhelp24.0.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: 天下搜索 - {56A7DC70-E102-4408-A34A-AE06FEF01586} - C:\WINNT\Downloaded Program Files\iebar23.0.dll O4 - HKLM\..\Run: [RegNetPass] C:\WINNT\system32\regcsp.exe O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab 运行LSPFix.exe 删除 quartz32.dll 附说明一份 LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。使用时，请关闭所有IE界面和文件夹界面后运行LSPFix，运行后，把要修复的那一个O10项从左边转到右边，点“Finish”即可。（不过这之前，需要在“I know what I`m doing”前面打勾。）双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名删除 c:\winnt\system32\quartz32.dll C:\WINNT\MSN.exe C:\WINNT\Downloaded Program Files\iebar23.0.dll C:\WINNT\system32\regcsp.exe C:\WINNT\Downloaded Program Files\barhelp24.0.dll 修复后重启，如果无法上网，请运行WinsockXPFix，让它修复一下。回到正常模式，请再扫日志粘上来。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

于维克托健康舞勺狮帖子:273 注册: 2006-06-15 来自:	发表于： 2006-07-16 21:43 \| 短消息资料字号：小中大 3楼下载超级兔子。 http://www.pctutu.com/srmsdown.asp 安装好后，打开“超级兔子清理王”“专业卸载,卸载所有提示的垃圾软件，卸载是不要打开任何浏览窗口。卸载不了可以重启后再去卸载。卸载完后，重启删除
于维克托健康舞勺狮帖子:273 注册: 2006-06-15 来自:

天天乐逍遥初生襁褓狮帖子:5 注册: 2006-07-16 来自:	发表于： 2006-07-17 02:01 \| 只看楼主短消息资料字号：小中大 4楼谢谢兄弟我已按上面做了不过quartz32.dll这个文件还是不能删一直显示该文件正在使用以下是日志 Logfile of HijackThis v1.99.1 Scan saved at 1:43:40, on 2006-7-17 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\Program Files\Rising\Rav\Ravmond.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\System32\SCardSvr.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\Program Files\Rising\Rav\RavStub.exe C:\WINNT\Explorer.EXE C:\WINNT\SOUNDMAN.EXE C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Rising\Rav\Ravmon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\木马清除专家 2006\mmqczj.exe C:\WINNT\system32\conime.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\fzjsms1\LOCALS~1\Temp\Rar$EX00.123\HijackThis.exe F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v14.dll O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing) O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [gemstrmw] C:\WINNT\system32\gemstrmw.exe /r O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\新建文件夹\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [木马清除专家] C:\Program Files\木马清除专家 2006\mmqczj.exe O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\QQ\AddToNetDisk.htm O8 - Extra context menu item: 使用KuGoo3下载(&K) - D:\Program Files\KuGoo3\KuGoo3DownX.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ\SendMMS.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: 易趣购物 - {DE607142-AC19-422e-868A-8D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing) O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607142-AC19-422e-868A-8D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing) O10 - Unknown file in Winsock LSP: c:\winnt\system32\quartz32.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\quartz32.dll O15 - Trusted Zone: http://www.icbc.com.cn O16 - DPF: {18F57D30-EF36-4C0E-9343-7BFA6DF79B4A} (XLink Class) - http://www.ycdy.com/swflash.CAB O16 - DPF: {5932517A-3326-4439-A708-1C98EDB5C549} (Downloader Class) - http://eacs.eqifa.com/mop/iMopDl.cab O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe O23 - Service: Yast User Switching . - Unknown owner - C:\WINNT\MSN.exe (file missing)
天天乐逍遥初生襁褓狮帖子:5 注册: 2006-07-16 来自:

mopery 卡卡技术团队帖子:17737 注册: 2005-12-06 来自:New York	发表于： 2006-07-17 03:30 \| 短消息资料字号：小中大 5楼修复 O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing) O23 - Service: Yast User Switching . - Unknown owner - C:\WINNT\MSN.exe (file missing) 打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 搜索Yast User Switching .删除...
mopery 卡卡技术团队帖子:17737 注册: 2005-12-06 来自:New York

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT