用瑞星手动扫描内存发现Backdoor.Gpigeon.ysi 　病毒。C盘被共享


Logfile of HijackThis v1.99.0
Scan saved at 14:11:44, on 2006-9-5
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
D:\ftc\Trojanwall.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\Program Files\jj4\jjsvr4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Rising\Rav\Rav.exe
C:\WINDOWS\system32\wuauclt.exe
F:\tools\HijackThis\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera (ZC0301PL)
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows木马防火墙] D:\ftc\Trojanwall.exe
O4 - HKCU\..\Run: [pyjj] C:\Program Files\jj4\jjsvr4.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 微软 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.microsoft.com/china/index.htm (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O11 - Options group: [TBH] 搜搜地址栏搜索
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20C2C286-BDE8-441B-B73D-AFA22D914DA5} (PowerList Control) - http://download.ppstream.com/bin/powerplayer.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {48FE89A0-486C-48DF-9DEC-BED22BDC6057} (XIsOro Control) - http://duiyi.sina.com.cn/download/OroCheck.cab
O16 - DPF: {53AF6E02-F18F-4228-AC13-3E79773FBE50} (CMCBooter Object) - http://download.mysee.com/plugin/booter.cab
O16 - DPF: {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} (photo_uploader Control) - http://upload.photo.163.com/photoup.cab
O16 - DPF: {A9E58728-1FA7-46CE-845D-44694EB11602} (XGiboView Control) - http://duiyi.sina.com.cn/giboview/giboview.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} - http://218.85.138.27/vqqsdl1009.cab
O16 - DPF: {F553811C-C2CE-4A33-90B4-A6D333FDF794} - http://222.217.240.23/ddvod/user/help/player/DreamPlayer/DreamSetup.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1D10DF1-4E9D-4789-BCE6-6C0997AF088A}: NameServer = 202.103.224.68
O23 - Service: GrayPigeon_Hacker.com.cn - Unknown - C:\WINDOWS\jiao.exe
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Process Communication Center - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: Windows Service Pack Installer update service - Promise Technology, Inc. - (no file)

修复：
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O23 - Service: GrayPigeon_Hacker.com.cn - Unknown - C:\WINDOWS\jiao.exe
灰鸽子，还是杀防的破解版，服务名都不改的。
在注册表展开
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
删除GrayPigeon_Hacker.com.cn项目

重启后删除：
C:\WINDOWS\jiao.exe
C:\WINDOWS\jiao.dll（如果有的话）
C:\WINDOWS\jiaoKey.dll（如果有的话）
C:\WINDOWS\jiao_hook.dll（如果有的话）
删除前将以上文件中所有能找到的用WINRAR压缩打包，加密码virus，发到我的邮箱（见签名）

修复
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O23 - Service: GrayPigeon_Hacker.com.cn - Unknown - C:\WINDOWS\jiao.exe
鸽子..安全模式...打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索GrayPigeon_Hacker.com.cn 删除..
删除
C:\WINDOWS\jiao.exe

已经修复：
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O23 - Service: GrayPigeon_Hacker.com.cn - Unknown - C:\WINDOWS\jiao.exe

已经在注册表展开
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
并删除GrayPigeon_Hacker.com.cn项目


C:\WINDOWS\jiao.exe
C:\WINDOWS\jiao.dll（如果有的话）
C:\WINDOWS\jiaoKey.dll（如果有的话）
C:\WINDOWS\jiao_hook.dll（如果有的话）
以上文件在安全模式和正常启动后均没有找到
回收站里面有一个JIAO.EXE -2C595E39.pf是否要删除？
用瑞星手动扫描内存已经没有病毒了