哪位老大帮我杀Backdoor.Gpigeon.ubj和Backdoor.Gpigeon.ugu病毒啊，谢谢！！~~~

救命啊！！~~~

【回复“门墩儿”的帖子】
灰鸽子。
请用HijackThis或autoruns扫日志贴上来看。

http://forum.ikaka.com/topic.asp?board=28&artid=6979213这个贴一楼有HijackThis工具下载。

怎么发不了啊？说我的内容过长呢

病毒路径是C:\Program Files\Internet Explorer\
iexplore.exe

引用:

【门墩儿的贴子】怎么发不了啊？说我的内容过长呢 ...........................

分成几段发

HijackThis_zwwºº»¯°æɨÃèÈÕÖ¾ V1.99.1
±£´æÓÚ      17:05:15, ÈÕÆÚ 2005-12-28
²Ù×÷ϵͳ£º  Windows XP SP1 (WinNT 5.01.2600)
ä¯ÀÀÆ÷£º    Internet Explorer v6.00 SP1 (6.00.2800.1106)

µ±Ç°ÔËÐеĽø³Ì£º         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\BCUP.exe
C:\Program Files\rising\Rav\RavTask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\rising\Rav\Ravmond.exe
C:\Program Files\rising\Rav\RavStub.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\rising\Rav\RavMon.exe
C:\WINDOWS\system32\sol.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.671\HijackThis1991zww.exe

R3 - URLSearchHook: ÑÅ»¢ÖúÊÖ - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
R3 - URLSearchHook: QQ Search Hook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
O2 - BHO: NaviHelperObj Class - {3E422F49-1566-40D3-B43D-077EF739AC32} - C:\WINDOWS\System32\NaviHelper.dll
O2 - BHO: ÑÅ»¢ÖúÊÖ - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\JCCATCH.DLL
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX
O3 - IE¹¤¾ßÀ¸ÔöÏî: µç̨(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE¹¤¾ßÀ¸ÔöÏî: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE¹¤¾ßÀ¸ÔöÏî: ½ðɽ¿ìÒë(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll
O3 - IE¹¤¾ßÀ¸ÔöÏî: ÑÅ»¢ÖúÊÖ - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O4 - Æô¶¯ÏîHKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - Æô¶¯ÏîHKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - Æô¶¯ÏîHKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - Æô¶¯ÏîHKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Æô¶¯ÏîHKLM\\Run: [NMGameX_AutoRun] C:\WINDOWS\System32\Rundll32.exe NMGameX.dll,LiveProcess /aa
O4 - Æô¶¯ÏîHKLM\\Run: [KAVRun] C:\KAV6\KAVRun.EXE
O4 - Æô¶¯ÏîHKLM\\Run: [Kulansyn] C:\KAV6\Kulansyn.EXE
O4 - Æô¶¯ÏîHKLM\\Run: [KpopMon] C:\KAV6\KpopMon.EXE
O4 - Æô¶¯ÏîHKLM\\Run: [iDuba Personal FireWall] C:\KAV6\KAVPFW.EXE
O4 - Æô¶¯ÏîHKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - Æô¶¯ÏîHKLM\\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
O4 - Æô¶¯ÏîHKLM\\Run: [BCUpdate] C:\WINDOWS\System32\BCUP.exe
O4 - Æô¶¯ÏîHKLM\\Run: [ADShow] C:\WINDOWS\System32\bcsysnote.exD
O4 - Æô¶¯ÏîHKLM\\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - Æô¶¯ÏîHKLM\\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - Æô¶¯ÏîHKLM\\Run: [AddrPlus3] RUNDLL32.EXE C:\PROGRA~1\TENCENT\AddrPlus\QAHook.dll,Rundll32
O4 - Æô¶¯ÏîHKLM\\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system
O4 - Æô¶¯ÏîHKLM\\Run: [SysExplr] C:\Program Files\Herosoft\Hero 9\SysExplr.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [winshost.exe] C:\WINDOWS\System32\winshost.exe
O4 - HKCU\..\Run: [RegBar] regsvr32.exe /u C:\progra~1\blogmark\bocaitoolbar.dll /s /i /n
O4 - Startup: ÌÚѶQQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe

O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: &ʹÓÃѸÀ×ÏÂÔØ - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: &ʹÓÃѸÀ×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: ÉÏ´«µ½QQÍøÂçÓ²ÅÌ - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: ʹÓÃKuGoo3ÏÂÔØ(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: ʹÓÃÍø¼Ê¿ì³µÏÂÔØ - C:\Program Files\FlashGet\jc_link.htm
O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: ʹÓÃÍø¼Ê¿ì³µÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\FlashGet\jc_all.htm
O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: ʹÓ󬼶½â°Ô²¥·Å - C:\Program Files\Herosoft\Hero 9\MPURLGET.HTM
O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: Ìí¼Óµ½QQ×Ô¶¨ÒåÃæ°å - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: Ìí¼Óµ½QQ±íÇé - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IEÓÒ¼ü²Ëµ¥ÖеÄÐÂÔöÏîÄ¿: ÓÃQQ²ÊÐÅ·¢Ë͸ÃͼƬ - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - ä¯ÀÀÆ÷¶îÍâµÄ°´Å¥: ºÆ·½¶Ôսƽ̨ - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\Program Files\ºÆ·½¶Ôսƽ̨\GameClient.exe
O9 - ä¯ÀÀÆ÷¶îÍâµÄ°´Å¥: Yahoo 1GµçÓÊ - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - ä¯ÀÀÆ÷¶îÍâµÄ°´Å¥: Ñ°±¦ÀÖȤ¶à - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - ä¯ÀÀÆ÷¶îÍâµÄ°´Å¥: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - ä¯ÀÀÆ÷¶îÍâµÄ¡°¹¤¾ß¡±²Ëµ¥Ïî: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - ä¯ÀÀÆ÷¶îÍâµÄ°´Å¥: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - ä¯ÀÀÆ÷¶îÍâµÄ¡°¹¤¾ß¡±²Ëµ¥Ïî: ÌÚѶQQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - ä¯ÀÀÆ÷¶îÍâµÄ°´Å¥: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - ä¯ÀÀÆ÷¶îÍâµÄ¡°¹¤¾ß¡±²Ëµ¥Ïî: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - ä¯ÀÀÆ÷¶îÍâµÄ°´Å¥: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - ä¯ÀÀÆ÷¶îÍâµÄ¡°¹¤¾ß¡±²Ëµ¥Ïî: QQìŲʹ¤¾ßÌõÉèÖà - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - ä¯ÀÀÆ÷¶îÍâµÄ°´Å¥: Çé¾°ÁÄÌì - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - ä¯ÀÀÆ÷¶îÍâµÄ°´Å¥: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - ä¯ÀÀÆ÷¶îÍâµÄ¡°¹¤¾ß¡±²Ëµ¥Ïî: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O11 - Options group: [TBH]  QQµØÖ·À¸ËÑË÷²å¼þ
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{36426160-EFA1-4FEA-A1B8-1FCB3B43A1DD}: NameServer = 10.0.0.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{36426160-EFA1-4FEA-A1B8-1FCB3B43A1DD}: NameServer = 10.0.0.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{36426160-EFA1-4FEA-A1B8-1FCB3B43A1DD}: NameServer = 10.0.0.2
O18 - ÁоÙÏÖÓеÄЭÒé: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINDOWS\System32\mbprot.dll
O23 - NT ·þÎñ: Gray_Pigeon_Server2.0 (GrayPigeonServer2.0) - Unknown owner - C:\WINDOWS\Sever.exe
O23 - NT ·þÎñ: PsShutdown (PsShutdownSvc) - Unknown owner - C:\WINDOWS\System32\PSSDNSVC.EXE (file missing)
O23 - NT ·þÎñ: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\CCenter.exe
O23 - NT ·þÎñ: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\Ravmond.exe
O23 - NT ·þÎñ: Windows Network Management (WinMgnt) - Unknown owner - C:\WINDOWS\SYSTEM\SVCHOST.EXE