闲话不多说了,每次开机杀毒都会杀出Backdoor.Gpigeon.qmm这个病毒,路径是C:\Program Files\Internet Explorer\IEXPLORE.EXE。
扫描的日志结果:
Logfile of HijackThis v1.99.1
Scan saved at 14:54:06, on 2007-7-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
D:\PROGRAM FILES\RISING\RAV\RavStub.exe
D:\Program Files\Tencent\QQLive\QQLive.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\桌面\HijackThis.exe
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - d:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - d:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: 使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: 讯通视频语音聊天 - {97C0CDFA-970D-4222-ADDE-6718E89E887C} - http://www.bdsystem.com/ (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.lenovo.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1184824324718
O16 - DPF: {EC53936E-6D4A-4307-9092-A2FC48EAFC56} (Web800 Control) - http://service.qq.com/web800.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F3B2D1D-DF7A-407B-9B4E-21A595BC7BF4}: NameServer = 219.146.0.130,219.150.32.132
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBF649DA-F6A4-47CF-9665-57B6DF803FDF}: NameServer = 219.146.0.130 219.150.32.132
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: Windows_ServerDdos - Unknown owner - C:\WINDOWS\system32\ddos.exe
请高手看下,我该怎么彻底删除这个病毒。
还有就是我的IE文件包里好象多了个东西,请高手看 下