Backdoor.Gpigeon.ytl 怎么杀？请高手指点（附日志）谢谢了 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 Backdoor.Gpigeon.ytl 怎么杀？请高手指点（附日志）谢谢了

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

Backdoor.Gpigeon.ytl 怎么杀？请高手指点（附日志）谢谢了

longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:	发表于： 2006-07-11 20:58 \| 只看楼主短消息资料字号：小中大 1楼 Backdoor.Gpigeon.ytl 怎么杀？请高手指点（附日志）谢谢了 F2 - REG:system.ini: UserInit=userinit.exe, O1 - Hosts: 218.5.72.87 www.cnww.net O1 - Hosts: 218.5.72.87 cnww.net O1 - Hosts: 218.5.72.87 www.7sou8sou.com O1 - Hosts: 218.5.72.87 7sou8sou.com O1 - Hosts: 218.5.72.87 www.zhao123.com O1 - Hosts: 218.5.72.87 zhao123.com O1 - Hosts: 218.5.72.87 www.4399.com O1 - Hosts: 218.5.72.87 4399.com O1 - Hosts: 218.5.72.87 www.chinagames.net O1 - Hosts: 218.5.72.87 chinagames.net O1 - Hosts: 218.5.72.87 www.tiexue.net O1 - Hosts: 218.5.72.87 tiexue.net O1 - Hosts: 218.5.72.87 www.qq163.com O1 - Hosts: 218.5.72.87 qq163.com O1 - Hosts: 218.5.72.87 www.tt67.com O1 - Hosts: 218.5.72.87 tt67.com O1 - Hosts: 218.5.72.87 www.chinamp3.com O1 - Hosts: 218.5.72.87 chinamp3.com O1 - Hosts: 218.5.72.87 www.pg168.com O1 - Hosts: 218.5.72.87 pg168.com O1 - Hosts: 218.5.72.87 www.yymp3.com O1 - Hosts: 218.5.72.87 yymp3.com O1 - Hosts: 218.5.72.87 www.yy138.com O1 - Hosts: 218.5.72.87 yy138.com O1 - Hosts: 218.5.72.87 www.dj99.com O1 - Hosts: 218.5.72.87 dj99.com O1 - Hosts: 218.5.72.87 www.sogua.com O1 - Hosts: 218.5.72.87 sogua.com O1 - Hosts: 218.5.72.87 www.snsn.net O1 - Hosts: 218.5.72.87 snsn.net O1 - Hosts: 218.5.72.87 www.flash8.net O1 - Hosts: 218.5.72.87 flash8.net O1 - Hosts: 218.5.72.87 www.mop.com O1 - Hosts: 218.5.72.87 mop.com O1 - Hosts: 218.5.72.87 www.tianyaclub.com O1 - Hosts: 218.5.72.87 tianyaclub.com O1 - Hosts: 218.5.72.87 www.xici.net O1 - Hosts: 218.5.72.87 xici.net O1 - Hosts: 218.5.72.87 www.ucanlove.com O1 - Hosts: 218.5.72.87 ucanlove.com O1 - Hosts: 218.5.72.87 www.cmfu.com O1 - Hosts: 218.5.72.87 cmfu.com O1 - Hosts: 218.5.72.87 www.21red.net O1 - Hosts: 218.5.72.87 21red.net O1 - Hosts: 218.5.72.87 www.pconline.com.cn O1 - Hosts: 218.5.72.87 pconline.com.cn O1 - Hosts: 218.5.72.87 www.donews.com O1 - Hosts: 218.5.72.87 donews.com O1 - Hosts: 218.5.72.87 www.pcauto.com.cn O1 - Hosts: 218.5.72.87 pcauto.com.cn O1 - Hosts: 218.5.72.87 www.265.com O1 - Hosts: 218.5.72.87 265.com O1 - Hosts: 218.5.72.87 www.wo99.com O1 - Hosts: 218.5.72.87 wo99.com O1 - Hosts: 218.5.72.87 www.familydoctor.com.cn O1 - Hosts: 218.5.72.87 familydoctor.com.cn O1 - Hosts: 218.5.72.87 www.flashempire.com O1 - Hosts: 218.5.72.87 flashempire.com O1 - Hosts: 218.5.72.87 www.showgood.tv O1 - Hosts: 218.5.72.87 showgood.tv O1 - Hosts: 218.5.72.87 www.flashfan.net O1 - Hosts: 218.5.72.87 flashfan.net O1 - Hosts: 218.5.72.87 www.long21.net O1 - Hosts: 218.5.72.87 long21.net O1 - Hosts: 218.5.72.87 www.sowww.com O1 - Hosts: 218.5.72.87 sowww.com O1 - Hosts: 218.5.72.87 www.flashhome.net O1 - Hosts: 218.5.72.87 flashhome.net O1 - Hosts: 218.5.72.87 www.cnflash.net O1 - Hosts: 218.5.72.87 cnflash.net O1 - Hosts: 218.5.72.87 www.flashsky.com O1 - Hosts: 218.5.72.87 flashsky.com O1 - Hosts: 218.5.72.87 www.hunansky.com O1 - Hosts: 218.5.72.87 hunansky.com O1 - Hosts: 218.5.72.87 www.52flash.net O1 - Hosts: 218.5.72.87 52flash.net O1 - Hosts: 218.5.72.87 www.flashh.com O1 - Hosts: 218.5.72.87 flashh.com O1 - Hosts: 218.5.72.87 www.flashsun.com O1 - Hosts: 218.5.72.87 flashsun.com O1 - Hosts: 218.5.72.87 www.7k7k.com O1 - Hosts: 218.5.72.87 7k7k.com O1 - Hosts: 218.5.72.87 www.xuanxuan.com O1 - Hosts: 218.5.72.87 xuanxuan.com O1 - Hosts: 218.5.72.87 www.flash88.net O1 - Hosts: 218.5.72.87 flash88.net O1 - Hosts: 218.5.72.87 www.91flash.com O1 - Hosts: 218.5.72.87 91flash.com O1 - Hosts: 218.5.72.87 www.doingflash.com O1 - Hosts: 218.5.72.87 doingflash.com O1 - Hosts: 218.5.72.87 www.5see.com O1 - Hosts: 218.5.72.87 5see.com O1 - Hosts: 218.5.72.87 www.skyhits.com O1 - Hosts: 218.5.72.87 skyhits.com O1 - Hosts: 218.5.72.87 www.ting78.com O1 - Hosts: 218.5.72.87 ting78.com O1 - Hosts: 218.5.72.87 www.91.com O1 - Hosts: 218.5.72.87 91.com O1 - Hosts: 218.5.72.87 www.flashchina.net O1 - Hosts: 218.5.72.87 flashchina.net O1 - Hosts: 218.5.72.87 www.flash8.com.cn O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - D:\WINDOWS\System32\xunleibho_v14.dll O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} - D:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper2006425_8222.dll O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll (file missing) O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - d:\PROGRA~1\chinanet\VNETTR~1.DLL O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - E:\Program Files\Tencent\QQ\QQIEHelper.dll O2 - BHO: HSProgSDT - {5D15CEAC-3B27-4863-AAEA-93A4C8A6C57D} - D:\WINDOWS\System32\hssdtobm.dll O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing) O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - D:\Program Files\BaiDu\bar\BaiduBar.dll O2 - BHO: BHelper - {8A4280AD-9B37-4922-A51D-73F3C3A32AF7} - D:\WINDOWS\System32\msibm\cfsbho.dll O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - D:\WINDOWS\Downloaded Program Files\barhelp23.0.dll O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A} - D:\WINDOWS\System32\obwbkya.dll O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - D:\Program Files\BaiDu\bar\BaiduBar.dll O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [C-Media Speaker Configuration] F:\声卡驱动\独立声卡\AV515M\WIN2K-XP\Setup.exe /SPEAKER O4 - HKLM\..\Run: [SiS Tray] D:\WINDOWS\System32\sistray.EXE O4 - HKLM\..\Run: [SiS KHooker] D:\WINDOWS\System32\khooker.exe O4 - HKLM\..\Run: [SiSUSBRG] D:\WINDOWS\sisUSBrg.exe O4 - HKLM\..\Run: [RavTimer] D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE O4 - HKLM\..\Run: [RavMon] D:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM O4 - HKLM\..\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [BigDogPath] D:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera O4 - HKLM\..\Run: [xkstartup] D:\WINDOWS\System32\spool\drivers\w32x86\2\ssccgo.exe Xerox WorkCentre XK Series O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [snpstd3] D:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [SiS Windows KeyHook] D:\WINDOWS\System32\keyhook.exe O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 添加到QQ自定义面板 - E:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - E:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\Program Files\Tencent\QQ\SendMMS.htm O8 - Extra context menu item: 百度--MP3搜索 - RES://D:\PROGRA~1\BaiDu\bar\baidubar.dll/BAIDUMP3.HTM O8 - Extra context menu item: 百度--图片搜索 - RES://D:\PROGRA~1\BaiDu\bar\baidubar.dll/BAIDUIMG.HTM O8 - Extra context menu item: 百度--新闻搜索 - RES://D:\PROGRA~1\BaiDu\bar\baidubar.dll/BAIDUNEWS.HTM O8 - Extra context menu item: 百度--歌词搜索 - RES://D:\PROGRA~1\BaiDu\bar\baidubar.dll/BAIDULYRIC.HTM O8 - Extra context menu item: 百度--网页搜索 - RES://D:\PROGRA~1\BaiDu\bar\baidubar.dll/BAIDUSEARCH.HTM O8 - Extra context menu item: 百度--词典搜索 - RES://D:\PROGRA~1\BaiDu\bar\baidubar.dll/BAIDU_DIC.HTM O8 - Extra context menu item: 百度--贴吧搜索 - RES://D:\PROGRA~1\BaiDu\bar\baidubar.dll/BAIDUPOST.HTM O9 - Extra button: (no name) - {3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} - D:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Link Filter - {3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} - D:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing) O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://bbsky.wuhan.net.cn/check/plugin/PowerPlr.ocx O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://shliao.com:1995/talk.cab O16 - DPF: {7253A666-8D4A-11D7-A4DC-00E04C504779} (BDC Control) - http://xmmliao.kmip.net/BDC.cab O16 - DPF: {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} (pcastup Class) - http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.8_20051009.cab O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://cache10.itv.mop.com/pCastCtl_1.0.0.87_20060601.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{B9FBE230-C014-4D25-BC3F-4BD7934C0748}: NameServer = 202.103.44.5 202.103.0.117 O21 - SSODL: DLMon - {590498A3-4131-4D8F-BA4B-36791A0803B1} - D:\WINDOWS\System32\DLMain.dll (file missing) O23 - Service: Database information combine (DbooInfo) - 易易加速科技有限公司 - D:\WINDOWS\dbmsinfo.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\Ravmond.exe O23 - Service: SDAgent Service (SDAgentService) - 北京兴华基业软件技术有限公司 - D:\Program Files\Common Files\smartde\sde.exe 2006-07-11 22:11:35
longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:	分享到：

longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:	发表于： 2006-07-11 21:15 \| 只看楼主短消息资料字号：小中大 2楼自己顶一下，哪位大哥帮帮忙啊。
longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:

longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:	发表于： 2006-07-11 21:17 \| 只看楼主短消息资料字号：小中大 3楼我顶顶顶！哭啊~~~~ 帮帮小弟啊...
longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-07-11 21:21 \| 短消息资料字号：小中大 4楼开始→运行→输入services.msc，打开“服务”→查找 Database information combine，SDAgent Service→双击→启动类型→禁止→停止→应用→确定。禁止Database information combine，SDAgent Service这2个服务（每一个逗号隔开的就是一个病毒的服务，请逐一禁用）关闭所有浏览窗口以及一些不必要的程序运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复"" O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} - D:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper2006425_8222.dll O2 - BHO: HSProgSDT - {5D15CEAC-3B27-4863-AAEA-93A4C8A6C57D} - D:\WINDOWS\System32\hssdtobm.dll O2 - BHO: BHelper - {8A4280AD-9B37-4922-A51D-73F3C3A32AF7} - D:\WINDOWS\System32\msibm\cfsbho.dll O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - D:\WINDOWS\Downloaded Program Files\barhelp23.0.dll O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A} - D:\WINDOWS\System32\obwbkya.dll O21 - SSODL: DLMon - {590498A3-4131-4D8F-BA4B-36791A0803B1} - D:\WINDOWS\System32\DLMain.dll (file missing) 重启双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名删除 D:\Program Files\Common Files\smartde D:\WINDOWS\dbmsinfo.exe D:\WINDOWS\System32\obwbkya.dll D:\WINDOWS\System32\msibm\cfsbho.dll D:\WINDOWS\System32\hssdtobm.dll D:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper2006425_8222.dll
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-07-11 21:22 \| 短消息资料字号：小中大 5楼忘了，还有修复所有的01项
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:	发表于： 2006-07-11 21:25 \| 只看楼主短消息资料字号：小中大 6楼无邪辛苦了，我试一下，谢谢了。
longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:

longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:	发表于： 2006-07-11 22:19 \| 只看楼主短消息资料字号：小中大 7楼感谢无邪大哥，问题解决了。谢谢~~~~~~~~~~~
longer777 初生襁褓狮帖子:12 注册: 2005-08-23 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT