tnnd，早上在网上资料，不清楚点了什么网站，还是学习网站，结果中了招，先是出现一些轻易就可以杀掉病毒，然后就不对头了，我本以为是灰鸽子病毒，用hijackthis1.99.1英文版查了一下没有，又用瑞星专杀也查不出来，看来不是，于是乎在安全模式下又全局杀了一遍，也没有病毒，但就在我重启后，tnnd启动时就瑞星监控就出现发现Backdoor.Gpigeon.ftq病毒，本来都以为杀了就没了，结果再重启还是有，实在没辙了，来请大侠给看一下，怎么才可以彻底杀掉该病毒呢？

Logfile of HijackThis v1.99.1
Scan saved at 18:46:47, on 2006-8-9
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\RPCS.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\SOUNDMAN.EXE
C:\Herosoft\HeroV8\SysExplr.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINNT\system32\conime.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\internt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\internt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
F:\hijackthis 修复IE\hijackthis\HijackThis.exe

R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\system32\internt.exe,C:\WINNT\system32\explore.exe
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v14.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: AssistHelper - {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} - C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4A40-8DFD-58B0666ABEBD} - C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [Super Rabbit SRRestore] F:\兔子魔法5.52版\MagicSet\SRRest.exe /autosave
O4 - HKLM\..\Run: [Super Rabbit Memory] F:\兔子魔法5.52版\MagicSet\memdef.EXE /LOAD
O4 - HKLM\..\Run: [SysExplr] C:\Herosoft\HeroV8\SysExplr.EXE
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: 添加到雅虎订阅(&Y) - res://C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll/YRSSMENUEXT
O8 - Extra context menu item: 雅虎搜索 - res://C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll/203
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1149490696125
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {BE9535B7-76FB-4572-AD20-B32BADB3643B} (TV Stream Source) - http://image2.sina.com.cn/cctv/Chaos203b.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{07DFC366-22C5-4B49-803E-6DD693F486F1}: NameServer = 202.102.192.68,202.102.199.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{07DFC366-22C5-4B49-803E-6DD693F486F1}: NameServer = 202.102.192.68,202.102.199.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{07DFC366-22C5-4B49-803E-6DD693F486F1}: NameServer = 202.102.192.68,202.102.199.68
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Routing and Remote SqlServer (Remote SQL) - Unknown owner - C:\WINNT\system32\su.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

楼上是我在删除雅虎助手以前扫描日志，我看在:
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Routing and Remote SqlServer (Remote SQL) - Unknown owner - C:\WINNT\system32\su.exe
这两行应该不是灰鸽子病毒吧，怎么看都不象，呵呵，楼下是我在删除雅虎助手以后，再次扫描结果，请大侠给看一下，Backdoor.Gpigeon.ftq这病毒，在c:\program files\internet explorer\下，有什么方法可以清除掉呢？谢谢

Logfile of HijackThis v1.99.1
Scan saved at 0:38:14, on 2006-8-10
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\RPCS.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\internt.exe
C:\WINNT\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\SOUNDMAN.EXE
C:\Herosoft\HeroV8\SysExplr.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Rising\Rav\rav.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Rising\KakaToolBar\KillProc.exe
C:\Program Files\Rising\KakaToolBar\KillProc.exe
F:\hijackthis 修复IE\hijackthis1.99\HijackThis.exe

R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll (file missing)
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\system32\internt.exe,C:\WINNT\system32\explore.exe
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v14.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\kakatool.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [Super Rabbit SRRestore] F:\兔子魔法5.52版\MagicSet\SRRest.exe /autosave
O4 - HKLM\..\Run: [Super Rabbit Memory] F:\兔子魔法5.52版\MagicSet\memdef.EXE /LOAD
O4 - HKLM\..\Run: [SysExplr] C:\Herosoft\HeroV8\SysExplr.EXE
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1149490696125
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {BE9535B7-76FB-4572-AD20-B32BADB3643B} (TV Stream Source) - http://image2.sina.com.cn/cctv/Chaos203b.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{07DFC366-22C5-4B49-803E-6DD693F486F1}: NameServer = 202.102.192.68,202.102.199.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{07DFC366-22C5-4B49-803E-6DD693F486F1}: NameServer = 202.102.192.68,202.102.199.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{07DFC366-22C5-4B49-803E-6DD693F486F1}: NameServer = 202.102.192.68,202.102.199.68
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Routing and Remote SqlServer (Remote SQL) - Unknown owner - C:\WINNT\system32\su.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

O23 - Service: Routing and Remote SqlServer (Remote SQL) - Unknown owner - C:\WINNT\system32\su.exe
鸽子..安全模式...打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索Remote SQL 删除..
删除
C:\WINNT\system32\su.exe

修复
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\system32\internt.exe,C:\WINNT\system32\explore.exe
删除
C:\WINNT\system32\explore.exe
C:\WINNT\system32\internt.exe

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)

to top

引用:

【mopery的贴子】O23 - Service: Routing and Remote SqlServer (Remote SQL) - Unknown owner - C:\WINNT\system32\su.exe 鸽子..安全模式...打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 搜索Remote SQL 删除.. 删除 C:\WINNT\system32\su.exe 修复 F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\system32\internt.exe,C:\WINNT\system32\explore.exe 删除 C:\WINNT\system32\explore.exe C:\WINNT\system32\internt.exe http://www.pctutu.com/srmsdown.asp 下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...) ………………

我的机子也中了,也是怎么也杀不了,现在是从百度度到这里了!
不太明白这4个步骤,
1\修改注册表-2\删除文件--3\修复文件---4\删除文件
是依次都要做的呢,还是任选选其一即可呢
还有,那个修复应该怎么修,我看不懂
还请高手帮忙!!!

四楼讲得很对，果然是他奶奶地灰鸽子病毒，我开始虽然怀疑，但还是以为不是病毒，就没有给杀掉，现在病毒被清除了，万分感谢，呵呵，就连重启也没有再发现上述病毒了，就是杀得时候很费力，explore.exe还简单点，不用在安全模式下就可以删除，但是internt.exe就算是在安全模式下都删除不掉，证明在安全模式下也启动了进程，没办法，后来用dos启动才删除掉，提醒大家注意一下

引用:

【菜菜菜啊的贴子】四楼讲得很对，果然是他奶奶地灰鸽子病毒，我开始虽然怀疑，但还是以为不是病毒，就没有给杀掉，现在病毒被清除了，万分感谢，呵呵，就连重启也没有再发现上述病毒了，就是杀得时候很费力，explore.exe还简单点，不用在安全模式下就可以删除，但是internt.exe就算是在安全模式下都删除不掉，证明在安全模式下也启动了进程，没办法，后来用dos启动才删除掉，提醒大家注意一下 ………………

我的机子感染的是explore.exe文件，请指点该怎么杀

引用:

【请您帮忙的贴子】 我的机子也中了,也是怎么也杀不了,现在是从百度度到这里了! 不太明白这4个步骤, 1\修改注册表-2\删除文件--3\修复文件---4\删除文件 是依次都要做的呢,还是任选选其一即可呢 还有,那个修复应该怎么修,我看不懂 还请高手帮忙!!! ………………

六楼朋友，你应该先斩草（修改注册）再除根（删除文件），方法很简单，用dos启动盘启动，然后dir /a,del internt.exe就可以啦，呵呵