Backdoor.Gpigeon.2006.zb
Backdoor.Gpigeon.2006.re日志如下
#T0 SecAnalyst 分析报告 版本:0, 4, 0, 47
#操作系统 : Microsoft Windows 2000 Professional Service Pack 4 (Build 2195) (CHS)
#系统目录 : C:\WINNT\system32
#浏览器  : Internet Explorer 5.00.3700.1000
#生成时间 : 2006-9-13 11:27:59

#T2 请把报告贴到安全救援中心bbs.s-sos.net,我们的专家会为你做出诊断，另外，报告中的安全风险值仅仅表示可疑程度。
#Q1 (请在此输入你的电脑遇到的问题和异常情况..)


#O4  危险    自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Yahoo Trojan Cleanner]-d:\progra~1\3721\ske\contmenu.dll
#O4  危险    自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Windows Script Host 的外壳扩展]-c:\winnt\system32\wshext.dll
#O4  警告    自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\RISING]-c:\winnt\system32\ravext.dll
#O4  警告    自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Shell Extensions for RealOne Player]-c:\program files\real\realplayer\rpshell.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\WinRAR shell extension]-c:\program files\winrar\rarext.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Message View]-d:\program files\nokia\nokia pc suite 6\messageview.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Contact View]-d:\program files\nokia\nokia pc suite 6\contactview.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\诺基亚手机浏览器]-d:\program files\nokia\nokia pc suite 6\phonebrowser.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\run\RfwMain]-"c:\program files\rising\rfw\rfwmain.exe" -startup
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Display Panning CPL Extension]-deskpan.dll [file not found]
#O4  低风险  自启动:[hkey_current_user\software\microsoft\windows\currentversion\run\MsnMsgr]-; "c:\program files\msn messenger\msnmsgr.exe" /background [file not found]
#O4  低风险  自启动:[hkey_current_user\software\microsoft\windows\currentversion\run\Super Rabbit IEPro]-; d:\program files\super rabbit\magicset\sriecli.exe /load [file not found]
#O4  低风险  自启动:[hkey_current_user\software\microsoft\windows\currentversion\run\PcSync]-; d:\program files\nokia\nokia pc suite 6\pcsync2.exe /nodialog [file not found]
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\run\TkBellExe]-; "c:\program files\common files\real\update_ob\realsched.exe"  -osboot [file not found]
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\run\DataLayer]-; c:\progra~1\common~1\pcsuite\datala~1\datala~1.exe [file not found]
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\run\PCSuiteTrayApplication]-; d:\program files\nokia\nokia pc suite 6\launch application 2.exe -onlytray [file not found]
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\nView Desktop Context Menu]-c:\winnt\system32\nvshell.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Desktop Explorer Menu]-c:\winnt\system32\nvshell.dll
#O4  低风险  自启动:[hkey_local_machine\software\microsoft\windows\currentversion\shell extensions\approved\Desktop Explorer]-c:\winnt\system32\nvshell.dll


#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\v124nt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\tonesnt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\spkpnt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\faxnt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\k56nt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\fsksnt.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\fallback.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\basic2.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\amosnt.sys
#D0  低风险  驱动: C:\Program Files\Rising\Rav\ExpScan.sys
#D0  低风险  驱动: C:\Program Files\Rising\Rav\HOOKAPI.SYS
#D0  低风险  驱动: C:\Program Files\Rising\Rav\hookbase.sys
#D0  低风险  驱动: c:\program files\rising\rfw\RfwBase.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\RMSPPPOE.SYS
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\winachsf.sys
#D0  低风险  驱动: C:\WINNT\system32\DRIVERS\rksample.sys
#D0  低风险  驱动: C:\WINNT\System32\Drivers\Cdralw2k.SYS
#D0  低风险  驱动: C:\WINNT\System32\Drivers\Cdr4_2K.SYS

#R0  警告    Homepage: http://www.cnool.net/ - HKCU\Software\Microsoft\Internet Explorer\Main, Start Page


#O3  警告    Toolbar: {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} -  - C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll

#M0  低风险  DLL:C:\WINNT\system32\vbscript.dll
#M0  低风险  DLL:C:\WINNT\system32\jscript.dll
#M0  低风险  DLL:C:\WINNT\system32\nvshell.dll

#P0  危险    进程:c:\program files\rising\rfw\rfwsrv.exe
#P0  危险    进程:c:\program files\rising\rav\ravmond.exe
#P0  警告    进程:c:\program files\rising\rav\rav.exe
#P0  警告    进程:c:\program files\rising\rav\ravstub.exe
#P0  低风险  进程:d:\program files\tencent\qqfo\qqnet.exe
#P0  低风险  进程:c:\program files\rising\rfw\rfwmain.exe
#P0  低风险  进程:d:\program files\tencent\qqfo\qqfo.exe

#S0  危险    NT 服务: hongkong windows - 启动方式: 自动 - 当前状态: 已停止 - C:\WINNT\hkfeng.exe
#S0  危险    NT 服务: RfwService - 启动方式: 自动 - 当前状态: 已启动 - c:\program files\rising\rfw\rfwsrv.exe
#S0  危险    NT 服务: RsRavMon - 启动方式: 自动 - 当前状态: 已启动 - "C:\Program Files\Rising\Rav\Ravmond.exe"
#S0  警告    NT 服务: WmdmPmSN - ServiceDll - C:\WINNT\system32\mspmsnsv.dll




您的电脑整体安全风险为中(72分)，请尽快咨询安全专家，协助处理!

Trojan.DL.Gpigeon.be又是一个，要怎么样杀告诉我一下

SecAnalyst用这个软件扫的

Logfile of HijackThis v1.99.1
Scan saved at 11:47:54, on 2006-9-13
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINNT\system32\internat.exe
D:\Program Files\Tencent\QQFO\QQNet.exe
D:\Program Files\Tencent\QQFO\qqfo.exe
D:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\Program Files\Rising\Rav\Rav.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\华视影院\新建文件夹\HijackThis.exe

O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [PCSuiteTrayApplication] ; D:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] ; C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [PcSync] ; D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Super Rabbit IEPro] ; D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O4 - HKCU\..\Run: [MsnMsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O8 - Extra context menu item: &使用迅雷下载 - d:\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WINNT\system32\shdocvw.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5599CE1-C0FC-420B-8ED3-059C6609A385}: NameServer = 202.96.104.16 202.96.104.26
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: hongkefen (hongkong windows) - Unknown owner - C:\WINNT\hkfeng.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

Backdoor.Gpigeon.2006.zb
Backdoor.Gpigeon.2006.re
那这两个是什么病毒呀。是不是因为我没有打2000的补丁才老中这种病毒的。一般2000程序安装好是不是要打两个后门补丁的。

日志贴好了高手看看呀

怎么没人看啊

高手们看一下，我电脑速度太慢了呀