瑞星卡卡安全论坛在线技术支持在线技术支持[已关闭] 紧急求助:我的电脑中了灰鸽子木马了?

12   1  /  2  页   跳转

紧急求助:我的电脑中了灰鸽子木马了?

紧急求助:我的电脑中了灰鸽子木马了?

请高手帮我分析一下:
HijackThis@Qoo的扫描日志  V1.97.7
Scan saved at 09:43:57 上午, on 2005-10-7
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\flexlm\安装\SolidWorks SolidNetWork License Manager\lmgrd.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\flexlm\安装\SolidWorks SolidNetWork License Manager\SW_D.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\WINDOWS\System32\svchost.exe
E:\Downloads\hijackthis1.97_qoo\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\JCCATCH.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {C5E5DB7E-46B1-47E6-8447-2E517F269925} - C:\Program Files\Xplus\GETIE.dll
O2 - BHO: (no name) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - (no file)
O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A} - C:\WINDOWS\system32\obwbkya.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - Global Startup: ntuser.dat
O4 - Global Startup: ntuser.dat.LOG
O8 - Extra context menu item:  添加到新浪点点通阅读器 - res://d:\PROGRA~1\Sina\ddt\RssReader.exe/RSSFEED.js
O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: Google 搜索(&G) - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 反向链接 - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 收藏到我的空间(佳禾文摘) - http://www.cn126.net/link.asp
O8 - Extra context menu item: 收藏此页到ViVi - http://vivi.sina.com.cn/collect/click.php?agent=ddt
O8 - Extra context menu item: 新浪搜索 - http://cha.sina.com.cn/ddt.html
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: 百度-搜索MP3 - res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度-搜索图片 - res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度-搜索新闻 - res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 百度-搜索歌词 - res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDULYRIC.HTM
O8 - Extra context menu item: 百度-搜索网页 - res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度-搜索贴吧 - res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUPOST.HTM
O8 - Extra context menu item: 类似网页 - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: 缓存的网页快照 - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: 翻译英文字词(&T) - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O9 - Extra button: TOL24 (HKLM)
O9 - Extra button: QQ (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {40CFEA79-ED5B-4B2B-8B8D-B567E40AF812} (sslclient Control) - http://www.tol24.com/download/ocx/sslclientnew.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9675ABBF-8D0B-4956-868C-934B5A7928D4} (Npv Control) - https://nprotect.lineage2.com.cn/nprotect/nprotect2004/ncsoft/npv.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-8D54A7E8A790} (GDIChk Object) - http://www.microsoft.com/security/controls/GDI/0/GDIChk.CAB
O16 - DPF: {D0A29C6C-AA71-4423-8C4A-5998B774C448} (IEDown Class) - http://download.ourgame.com/IEDown2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - https://nprotect.lineage2.com.cn/nprotect/keycrypt/npkcx.cab
O16 - DPF: {E3CC1E13-9428-4570-919C-92815DB22920} (VD2Loader Control) - http://vcds-client2.lineage2.com.cn/vcds-client/VD2Loader2.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab

-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
最后编辑2005-10-08 15:12:55
分享到:
gototop
 

都好几天了,瑞星每次杀毒都提示内存浏览器杀了两个灰鸽子病毒.每次开机防火墙也提示杀掉灰鸽子木马.但是每次都有病毒出现.-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
gototop
 

我帮你顶,我的也感染了-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
gototop
 

谢谢,同病相怜!急死我了!!!-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
gototop
 

有类似问题的朋友帮忙顶一下,希望能引起高手的注意.在此谢谢了!-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
gototop
 

同是天涯伦落人-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
gototop
 

我的每天启动,系统开机自动启动项里面,挨个查出来,从头删到尾,今天就算好了,第二天开机,毛病依旧,而且,每次杀毒都能从c:\windows里杀出一个serverr.dll,每天查杀,每天有。-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
gototop
 

再系统安全模式下查到Backdoor.Gpigeon.pr,杀掉后又被查到

这个病毒反反复复被查到,反反复复被杀掉

现在计算机里还有

-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
gototop
 

没想到灰鸽子如此的讨厌,谁能出来为民除害?在此谢过了!!!!-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
gototop
 

看来是石沉大海了.没有高手指教了.失望中.........-ä×`$½¬Ãûbbs.ikaka.com—Êýh»’ð—
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT