Backdoor.Gpigeon.dq灰鸽子变种～谁能杀 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 Backdoor.Gpigeon.dq灰鸽子变种～谁能杀

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

Backdoor.Gpigeon.dq灰鸽子变种～谁能杀

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 13:50 \| 显示全部短消息资料字号：小中大 1楼 Backdoor.Gpigeon.dq灰鸽子变种～谁能杀现象～禁用注册表～经常重起～谁有办法啊～ 2006-05-28 19:37:15
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	分享到：

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 14:05 \| 显示全部短消息资料字号：小中大 2楼我想用HijackThis1给各位出个报告~但是一运行马上重起~我去安全模式运行也是一样~怎么办啊~我都快急晕了~
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 14:07 \| 显示全部短消息资料字号：小中大 3楼我没办法只能用SREng出了个报告 006-05-28,14:05:22 System Repair Engineer 2.0.12.350 (2.0 RC 1) Windows XP Home Edition Service Pack 2 - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <Tok-Cirrhatus><"C:\Documents and Settings\xboy1983\Local Settings\Application Data\smss.exe"> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <eMuleAutoStart><; C:\Program Files\eMule\eMule.exe -AutoStart> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <KuGoo3><; "C:\PROGRA~1\KUGOO3\KUGOO.EXE"> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <MsnMsgr><; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <Super Rabbit IEPro><; C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <LaunchApp><Alaunch> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <SoundMan><SOUNDMAN.EXE> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <LManager><C:\PROGRA~1\LAUNCH~1\CPLFL32.EXE> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <Bron-Spizaetus><"C:\WINDOWS\ShellNew\sempalong.exe"> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <AGRSMMSG><; AGRSMMSG.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <ATIModeChange><; Ati2mdxx.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <ATIPTA><; C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <bgoomain.exe><; C:\PROGRA~1\baigoo\bgoomain.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <HotKeysCmds><; C:\WINDOWS\System32\hkcmd.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IgfxTray><; C:\WINDOWS\System32\igfxtray.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <iTunesHelper><; "C:\Program Files\iTunes\iTunesHelper.exe"> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <NTdhcp><; C:\WINDOWS\system32\NTdhcp.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PCMService><; "C:\Program Files\Aspire Arcade\PCMService.exe"> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <ShowIcon_Chander_CRW Series Driver v1.17r019><; "C:\Program Files\CRW\shwicon.exe" -t"Chander\CRW Series Driver v1.17r019"> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <SunJavaUpdateSched><; C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <SynTPEnh><; C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <SynTPLpr><; C:\Program Files\Synaptics\SynTP\SynTPLpr.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <YLive.exe><; > [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe "C:\WINDOWS\BerasJatah.exe"> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <Userinit><C:\WINDOWS\system32\userinit.exe,> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><>
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 14:08 \| 显示全部短消息资料字号：小中大 4楼 ================================== 启动文件夹 [Empty] <C:\Documents and Settings\xboy1983\「开始」菜单\程序\启动\Empty.pif><N> ================================== 服务 [Ati HotKey Poller / Ati HotKey Poller] <C:\WINDOWS\System32\Ati2evxx.exe><N/A> [ATI Smart / ATI Smart] <C:\WINDOWS\system32\ati2sgag.exe><> [Clever / Clever] <C:\WINDOWS\G_Server2006.exe><N/A> [InstallDriver Table Manager / IDriverT] <"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation> [Internet Connection Firewall / Internet Connection Firewall] <C:\WINDOWS\TASKMAM.EXE><N/A> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [schost / schost] <C:\WINDOWS\schost.exe><N/A> [svchost.exe / svchost.exe ] <C:\WINDOWS\win32.ini><N/A> [Update server / Update server ] <C:\Program Files\HgzServer\G_Server1.2.exe><N/A> [Network Management Center Task / W32Tasks] <C:\WINDOWS\system32\taskman32.exe><N/A> [windows_Server / windowsServer] <C:\WINDOWS\windows.exe><N/A> ================================== 浏览器加载项 [ThunderIEHelper Class] {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD> [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [IeCatch2 Class] {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft> [] {A9930D97-9CF0-42A0-A10D-4F28836579D5} <C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A> [NTIECatcher Class] {C56CB6B0-0D96-11D6-8C65-B2868B609932} <C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll, Xi> [RGWIE Class] {D4D5806E-EA2C-45b2-972D-8BE237697B87} <RGWIE.dll, > [超级兔子上网精灵] {FEDF637B-F631-4583-A210-33CC828D42DB} <C:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL, 超级兔子> [浩方对战平台] {0A155D3C-68E2-4215-A47A-E800A446447A} <C:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司> [Create Mobile Favorite] {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} <C:\PROGRA~1\MICROS~2\INetRepl.dll, Microsoft Corporation> [Create Mobile Favorite] {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} <C:\PROGRA~1\MICROS~2\INetRepl.dll, Microsoft Corporation> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [FlashGet] {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft> [易趣购物] {DE607143-AC19-423e-868A-8D70ABDF119A} <http://click2.ad4all.net/url2/urlmanage/url.asp?id=5, N/A> [QQIEFloatBarCfgCmd Class] {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft> [超级兔子上网精灵] {FEDF637B-F631-4583-A210-33CC828D42DB} <C:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL, 超级兔子> [AxInputControl Class] {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, > [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.> [ThunderIEHelper Class] {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD> [ActiveMovieControl Object] {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [Windows Media Player]
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 14:08 \| 显示全部短消息资料字号：小中大 5楼 {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\System32\mshtml.dll, N/A> [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation> [Tabular Data Control] {333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\System32\tdc.ocx, Microsoft Corporation> [IETag Factory] {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation> [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\System32\msxml3.dll, N/A> [HHCtrl Object] {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [AxInputControl Class] {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, > [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\System32\shdocvw.dll, Microsoft Corporation> [AxSubmitControl Class] {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, > [IeCatch2 Class] {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft> [] {A9930D97-9CF0-42A0-A10D-4F28836579D5} <C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A> [YLauncher Class] {AC036CB4-328D-4DB4-A707-4147B6C20266} <C:\WINDOWS\system\ephTool.dll, > [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\System32\mshtml.dll, Microsoft Corporation> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\System32\shdocvw.dll, N/A> [NTIECatcher Class] {C56CB6B0-0D96-11D6-8C65-B2868B609932} <C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll, Xi> [VIDEO__X_MS_ASF Moniker Class] {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.> [RGWIE Class] {D4D5806E-EA2C-45B2-972D-8BE237697B87} <RGWIE.dll, > [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft> [超级兔子上网精灵] {FEDF637B-F631-4583-A210-33CC828D42DB} <C:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL, 超级兔子> [&使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A> [&使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A> [上传到QQ网络硬盘] <C:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A> [使用KuGoo3下载(&K)] <C:\Program Files\KuGoo3\KuGoo3DownX.htm, N/A> [使用影音传送带下载] <C:\Program Files\Xi\NetTransport 2\NTAddLink.html, N/A> [使用影音传送带下载全部链接] <C:\Program Files\Xi\NetTransport 2\NTAddList.html, N/A> [使用网际快车下载] <C:\PROGRA~1\FLASHGET\jc_link.htm, N/A> [使用网际快车下载全部链接] <C:\PROGRA~1\FLASHGET\jc_all.htm, N/A> [导出到 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000, N/A> [添加到QQ自定义面板] <C:\Program Files\Tencent\qq\AddPanel.htm, N/A> [添加到QQ表情] <C:\Program Files\Tencent\qq\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <C:\Program Files\Tencent\qq\SendMMS.htm, N/A> [百度--MP3搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUMP3.HTM, N/A> [百度--图片搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUIMG.HTM, N/A> [百度--地图搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_MAP.HTM, N/A> [百度--新闻搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUNEWS.HTM, N/A> [百度--歌词搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDULYRIC.HTM, N/A> [百度--知道搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_ZHIDAO.HTM, N/A> [百度--硬盘搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_DISK.HTM, N/A> [百度--站内搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_SITE.HTM, N/A> [百度--网页搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUSEARCH.HTM, N/A> [百度--词典搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_DIC.HTM, N/A> [百度--贴吧搜索] <RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUPOST.HTM, N/A> ================================== 正在运行的进程 [PID: 728][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 800][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 824][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 868][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 880][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1036][C:\WINDOWS\System32\Ati2evxx.exe] <N/A><N/A> [PID: 1048][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1128][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1268][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 1288][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1332][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1480][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1524][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 3> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17> [C:\Program Files\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9> [C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28> [C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8> [C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 4> [C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21> [C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18,
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 14:09 \| 显示全部短消息资料字号：小中大 6楼 0, 0, 5> [C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\Program Files\Rising\Rav\RsStore.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\posttrtx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 1> [C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\ExtMail.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8> [PID: 1852][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)> [PID: 1940][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [PID: 540][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)> [PID: 1000][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [C:\WINDOWS\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62> [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><6.0.0.2003051500> [C:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5> [C:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0> [C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A> [C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll] <Xi><1.60.11> [C:\WINDOWS\system32\RGWIE.dll] <><1, 0, 0, 1> [C:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL] <超级兔子><1.0.7.7> [PID: 292][C:\WINDOWS\Explorer.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [C:\PROGRA~1\彩色文~1\cmext.dll] <Revenger inc.><1.2.1.2> [PID: 656][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 236][C:\WINDOWS\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5.1.0.24> [PID: 676][C:\PROGRA~1\LAUNCH~1\CPLFL32.EXE] <Dritek System Inc.><1,2,0,1> [C:\PROGRA~1\LAUNCH~1\ComFnUtl.dll] <Dritek System Inc.><1.00> [C:\PROGRA~1\LAUNCH~1\LgKCUtl.dll] <Dritek System Inc.><2, 0, 1, 1> [C:\PROGRA~1\LAUNCH~1\SzUPFUtl.dll] <Dritek System Inc.><1.00> [C:\PROGRA~1\LAUNCH~1\OSDUtl.dll] <Dritek System Inc.><1.00> [C:\PROGRA~1\LAUNCH~1\RgnMaker.dll] <Dritek System Inc.><12.07.1999 ( VC60 )> [C:\PROGRA~1\LAUNCH~1\CDRomUtl.dll] <Dritek System Inc.><1.00> [C:\PROGRA~1\LAUNCH~1\MixerUtl.dll] <Dritek System Inc.><1.00> [C:\PROGRA~1\LAUNCH~1\Wnd2File.dll] <Dritek System Inc.><3.00> [C:\PROGRA~1\LAUNCH~1\SzPtcUtl.dll] <Dritek System Inc.><1.00> [C:\PROGRA~1\LAUNCH~1\PowerUtl.dll] <N/A><N/A> [C:\PROGRA~1\LAUNCH~1\DialCnt.Dll] <Dritek System Inc.><1.10> [PID: 1548][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 1564][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 99> [C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 1816][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1380][C:\Documents and Settings\xboy1983\Local Settings\Application Data\winlogon.exe] <N/A><N/A> [PID: 2220][C:\Documents and Settings\xboy1983\Local Settings\Application Data\services.exe] <N/A><N/A> [PID: 2228][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 2284][C:\Documents and Settings\xboy1983\Local Settings\Application Data\lsass.exe] <N/A><N/A> [PID: 2964][C:\Program Files\Rising\Rav\CopyRun\RavCopy.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\PROGRAM FILES\RISING\RAV\COPYRUN\Update.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 38> [PID: 3064][C:\WINDOWS\system32\wuauclt.exe] <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)> [PID: 3424][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [C:\WINDOWS\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62> [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><6.0.0.2003051500> [C:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5> [C:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0> [C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A> [C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll] <Xi><1.60.11> [C:\WINDOWS\system32\RGWIE.dll] <><1, 0, 0, 1> [C:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL] <超级兔子><1.0.7.7> [C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0> [PID: 3176][C:\Program Files\BitComet\BitComet.exe] <www.BitComet.com><0.61.> [C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 3952][C:\Documents and Settings\xboy1983\Local Settings\Application Data\inetinfo.exe] <N/A><N/A> [PID: 1908][C:\Documents and Settings\xboy1983\桌面\SREng.exe] <Smallfrogs Studio><2.0.12.350> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 ==================================
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 15:07 \| 显示全部短消息资料字号：小中大 7楼哪位老大救救命啊~我帖字都要尘到水底了啊~99999999我吧
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 15:10 \| 显示全部短消息资料字号：小中大 8楼刚刚用瑞星杀的报告~但是我怕重起后又变成以前那样了... 瑞星病毒查杀结果报告提交者：Rav 系统版本：Microsoft Windows XP Home Edition 补丁版本：Service Pack 2 Build 2600 IE版本：6.0.2900.2180 MAC地址：00:02:3F:18:2C:F4 IP地址：192.168.18.13 本次扫描文件数： 153669 个本次扫描时间：2769 秒发现病毒种类： 5 种查杀病毒种类： 5 种未清除病毒种类列表：发现病毒种类列表：病毒： Worm.Mail.Brontok.g 次数： 3 病毒： Backdoor.Gpigeon.tzr 次数： 2 病毒： Backdoor.Gpigeon.dq 次数： 1 病毒： Backdoor.Gpigeon.tki 次数： 1 病毒： Backdoor.Gpigeon.5.dq 次数： 1
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 16:28 \| 显示全部短消息资料字号：小中大 9楼刚刚更新好最新瑞星~杀毒报告如下~请问我还要按轩辕小聪的方法弄吗~还是已经好了病毒名称处理结果发现日期扫描方式路径文件病毒来源 Backdoor.Gpigeon.dq 删除成功 2006-05-28 14:46 手动扫描 C:\System Volume Information\_restore{EC3CB646-0039-4266-8A61-C25E72DF9D9B}\RP74 A0076224.DLL 本机 Backdoor.Gpigeon.tki 删除成功 2006-05-28 14:46 手动扫描 C:\System Volume Information\_restore{EC3CB646-0039-4266-8A61-C25E72DF9D9B}\RP74 A0076227.DLL 本机 Backdoor.Gpigeon.ukg 清除成功 2006-05-28 15:23 手动扫描 IEXPLORE.EXE>>C:\Program Files\Internet Explorer\IEXPLORE.EXE 本机 Backdoor.Gpigeon.ddi 清除成功 2006-05-28 15:23 手动扫描 IEXPLORE.EXE>>C:\Program Files\INTERNET Explorer\IEXPLORE.EXE 本机 Backdoor.Gpigeon.cal 删除成功 2006-05-28 15:31 手动扫描 C:\WINDOWS\system32 taskman32.exe 本机 Trojan.PSW.QQRobber.oh 删除成功 2006-05-28 15:31 手动扫描 C:\WINDOWS\system32 NTdhcp.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:31 手动扫描 C:\WINDOWS\system32 xboy1983"s Setting.scr 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:31 手动扫描 C:\WINDOWS\system32 Administrator"s Setting.scr 本机 Backdoor.Gpigeon.urw 删除成功 2006-05-28 15:33 手动扫描 C:\WINDOWS win32.ini 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:34 手动扫描 C:\WINDOWS\SHELLNEW sempalong.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:35 手动扫描 C:\WINDOWS\pss Empty.pifStartup 本机 Backdoor.Delf.tjj 删除成功 2006-05-28 15:36 手动扫描 C:\WINDOWS TASKMAM.EXE 本机 Backdoor.Gpigeon.dtq 删除成功 2006-05-28 15:36 手动扫描 C:\WINDOWS schost.exe 本机 Backdoor.Gpigeon.2006.a 删除成功 2006-05-28 15:36 手动扫描 C:\WINDOWS G_Server2006.DLL 本机 Backdoor.Gpigeon.2006.a 删除成功 2006-05-28 15:37 手动扫描 C:\WINDOWS G_Server2006Key1.DLL 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:37 手动扫描 C:\WINDOWS BerasJatah.exe 本机 Trojan.Multidrp.hx 删除成功 2006-05-28 15:38 手动扫描 C:\Documents and Settings\xboy1983\Local Settings\Temp\nst32.tmp DivXComponentInstaller.exe 本机
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:

xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:	发表于： 2006-05-28 16:29 \| 显示全部短消息资料字号：小中大 10楼本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:38 手动扫描 C:\Documents and Settings\xboy1983\Local Settings\Application Data winlogon.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:38 手动扫描 C:\Documents and Settings\xboy1983\Local Settings\Application Data smss.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:38 手动扫描 C:\Documents and Settings\xboy1983\Local Settings\Application Data services.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:38 手动扫描 C:\Documents and Settings\xboy1983\Local Settings\Application Data lsass.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:38 手动扫描 C:\Documents and Settings\xboy1983\Local Settings\Application Data inetinfo.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:38 手动扫描 C:\Documents and Settings\xboy1983\Local Settings\Application Data csrss.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:38 手动扫描 C:\Documents and Settings\xboy1983\Templates Brengkolang.com 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:38 手动扫描 C:\Documents and Settings\xboy1983\「开始」菜单\程序\启动 Empty.pif 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\PHOTO PHOTO.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\明星明星.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\乌鲁木齐乌鲁木齐.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\TVB2006 TVB2006.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\so so.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\东方同人系列东方同人系列.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\2006 world cup 2006 world cup.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1024-768 云中仙境云雾中的山景 1024-768 云中仙境云雾中的山景.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1600-1200 像素的大自然壁纸，非常漂亮 1600-1200 像素的大自然壁纸，非常漂亮.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1024-768 Hanapoo桌面系列精美壁纸 1024-768 Hanapoo桌面系列精美壁纸.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1024-768 kagaya梦幻星空壁纸系列 1024-768 kagaya梦幻星空壁纸系列.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1024-768 非常漂亮的XP主题设计壁纸 1024-768 非常漂亮的XP主题设计壁纸.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1024-768 韩国卡通风格桌面，清新淡雅 1024-768 韩国卡通风格桌面，清新淡雅.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1024-768 极品迷人大自然景色壁纸 1024-768 极品迷人大自然景色壁纸.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1024-768 请珍惜每一刻精美壁纸 1024-768 请珍惜每一刻精美壁纸.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1024-768 哇!蓝天白云风光壁纸 1024-768 哇!蓝天白云风光壁纸.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地\1024-768风景图片 1024-768风景图片.exe 本机 Worm.Mail.Brontok.bs 删除成功 2006-05-28 15:39 手动扫描 C:\Documents and Settings\xboy1983\My Documents\图片聚集地
xboy1983 初生襁褓狮帖子:31 注册: 2006-05-28 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT