最近中了Backdoor.Gpigeon.qmm怎么也删不了,用瑞星删了可每次重起又有了.哪位高手帮帮我啊,这里先谢谢了!!!!

下载SRENG,扫日志上来

怎么下日志啊,不懂啊

怎么没人帮我啊

置顶的工具帖子中下载SREng，运行智能扫描，保存报告，分段贴上来！

==================================
正在运行的进程
[PID: 556][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 628][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1300][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  [Tencent, 4, 4, 2, 30]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [C:\WINDOWS\G_Server2007.DLL]  [N/A, ]
    [C:\Program Files\FlashGet\fgmgr.dll]  [www.flashget.com, 1, 8, 0, 1001]
    [C:\Program Files\BitComet\tools\BitCometBHO.dll]  [BitComet, 20061116]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [f:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\TENCENT\Adplus\SSAddr1.dll]  [Tencent, 4, 4, 2, 22]
    [C:\Program Files\FlashGet\jccatch.dll]  [www.flashget.com, 1, 8, 0, 1001]
    [C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll]  [Xi, 1.91.12]
[PID: 1448][d:\Program Files\Rising\Rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
==================================
API HOOK
入口点错误：NtQuerySystemInformation (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\G_Server2007.DLL)
入口点错误：NtTerminateProcess (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\G_Server2007.DLL)
入口点错误：ZwTerminateProcess (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\G_Server2007.DLL)
入口点错误：EnumServicesStatusA (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\G_Server2007.DLL)
入口点错误：EnumServicesStatusW (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\G_Server2007.DLL)
入口点错误：FindNextFileA (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\G_Server2007.DLL)
入口点错误：FindNextFileW (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\G_Server2007.DLL)

==================================
隐藏进程
    [2400] C:\WINDOWS\G_Server2007.exe

==================================

贴日志先

要全部的

[CODE]

2007-03-23,12:37:44

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <boot-hf><c:\windows\BOOT-hf.exe>  [N/A]
    <TaoXiBag><F:\Program Files\淘洗坊\淘洗袋\TaoXiBag.exe /onstartup>  [ ]
    <swg><C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe>  [(Verified)Google Inc]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <snpstd3><C:\WINDOWS\vsnpstd3.exe>  []
    <stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe>  [Tencent]
    <RavTask><"f:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <PCSuiteTrayApplication><F:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup>  [Nokia]
    <WangWang><"F:\淘宝旺旺\淘宝旺旺\WangWang.EXE">  [淘宝（中国）软件有限公司]
    <RfwMain><"d:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\Windows\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{08315C1A-9BA9-4B7C-A432-26885F78DF28}><>  [N/A]

==================================
启动文件夹
[腾讯QQ]
  <C:\Documents and Settings\new\「开始」菜单\程序\启动\腾讯QQ.lnk --> F:\PROGRA~1\QQ2005\QQ.exe [TENCENT]><N>

==================================
服务
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Automatic Updatoes / Automatic Updatoes][Stopped/Auto Start]
  <C:\WINDOWS\Hacker.com.cn.exe><N/A>
[Google Updater Service / gusvc][Stopped/Manual Start]
  <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Imsvc / Imsvc][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\Webmail.dll><>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <d:\Program Files\Rising\Rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Remote Procedure Fall System(RPFS) / RpfS][Stopped/Auto Start]
  <C:\WINDOWS\system32\EXPL0RER.EXE><N/A>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"f:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"f:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[ServiceLayer / ServiceLayer][Running/Manual Start]
  <"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"><Nokia.>
[Systeml / Systeml][Stopped/Auto Start]
  <C:\WINDOWS\svchost.exe><N/A>
[Windows XP Vista        / Windows XP Vista        ][Stopped/Auto Start]
  <C:\WINDOWS\alg.exe><N/A>
[Windows_ServerDdos / Windows_ServerDdos][Stopped/Auto Start]
  <C:\WINDOWS\system32\ddos.exe><N/A>

==================================

用“冰剑”选中G_server2007进程，单击右键，结束进程。结束进程后，点冰刃左边的文件，浏览到程序名称提示的文件夹，找到g_server2007.exe和g_server2007.DLL（灰鸽子中毒后的文件名各不相同，是由攻击者定制的，应尽可能根据冰刃提示的路径去查找。有的版本带有_hook.dll，可以查看下文件日期，应该是同时生成的。）点击右键，彻底删除掉。