顽固的灰鸽子 Backdoor.Gpigeon.uql 变种 Backdoor.Win32.Hupigon.cda

绝地灬酷狼 2024-04-20 11:15 68阅读 0赞

**endurer**　原创  
2006-08-26 第**1**版

一位网友的电脑，这两天瑞星开机扫描总报告发现 **Backdoor.Gpigeon.uql**。如：  
\-----------  
病毒名称 处理结果 发现日期 路径文件病毒来源  
**Backdoor.Gpigeon.uql** 清除成功 2006-08-25 08:19 IEXPLORE.EXE>>C:/Program Files/Internet Explorer/IEXPLORE.EXE本机  
\-----------/

使用HijackThis（可以到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载）扫描log，发现N多可疑项：

/---------  
Logfile of HijackThis v1.99.1  
Platform: Windows XP SP2 (WinNT 5.01.2600)  
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

R3 - URLSearchHook: (no name) - \{BFCD2BAD-DE01-433E-A751-731B77EF84AD\} - C:/WINDOWS/system32/Zzwcrh.dll (file missing)  
R3 - URLSearchHook: (no name) - \{808B6AF8-F101-4AF7-AC49-98D403B16FBA\} - C:/WINDOWS/system32/Uhxwtr.dll (file missing)  
R3 - URLSearchHook: (no name) - \{DB020387-4489-4B9B-AF88-1AF9357CAA18\} - C:/WINDOWS/system32/Paiy.dll  
R3 - URLSearchHook: (no name) - \{E68EF228-54B9-4F82-96F3-55DDBE3855FE\} - C:/WINDOWS/system32/Wqonu.dll  
R3 - URLSearchHook: (no name) - \{8446B2EE-C04C-4C5D-9706-2FFB46E89B62\} - C:/WINDOWS/system32/Mihu.dll  
R3 - URLSearchHook: (no name) - \{59172C14-06B4-40C8-9A95-BC71C73BF5AF\} - C:/WINDOWS/system32/Ivaeye.dll (file missing)  
R3 - URLSearchHook: (no name) - \{EB6E4937-8C1D-4422-A928-A955BF4050A5\} - C:/WINDOWS/system32/Gmuseq.dll (file missing)  
R3 - URLSearchHook: (no name) - \{E238864E-8FC0-4964-A119-8C219FD3FCA5\} - C:/WINDOWS/system32/Qgungz.dll (file missing)  
R3 - URLSearchHook: (no name) - \{9CF077C6-E3CE-435B-B6EF-9ED2308051EA\} - C:/WINDOWS/system32/Kmdlim.dll (file missing)  
R3 - URLSearchHook: (no name) - \{5B83669A-3EF7-4E7D-ACC0-2DE10FAF1D8E\} - C:/WINDOWS/system32/Fxai.dll (file missing)  
R3 - URLSearchHook: (no name) - \{717BB5F3-D783-44AD-A672-FBE9FF014212\} - C:/WINDOWS/system32/Jzwz.dll (file missing)  
R3 - URLSearchHook: (no name) - \{2280D518-EAFC-4E5F-8137-95459A65E71D\} - C:/WINDOWS/system32/Bktql.dll (file missing)  
R3 - URLSearchHook: (no name) - \{B864F7E0-8EC6-4F40-A5D2-6DF6E7218916\} - C:/WINDOWS/system32/Xnskic.dll (file missing)  
R3 - URLSearchHook: (no name) - \{7A68C18B-5050-49A1-89A2-EC2A4C9AD4D4\} - C:/WINDOWS/system32/Aseuxe.dll (file missing)  
R3 - URLSearchHook: (no name) - \{9D0E044F-4C70-4AE0-99CE-DC3C730C6AD5\} - C:/WINDOWS/system32/Tpuwa.dll (file missing)  
R3 - URLSearchHook: (no name) - \{0314B9FB-5711-49D8-AA91-51DA09E0E725\} - C:/WINDOWS/system32/Enkjvz.dll (file missing)  
R3 - URLSearchHook: (no name) - \{F3E2FC60-FB25-4050-8F98-6DC54343E838\} - C:/WINDOWS/system32/Lrfpy.dll (file missing)  
R3 - URLSearchHook: (no name) - \{4FEE26D2-50EA-452C-AA9C-7FE89EED2014\} - C:/WINDOWS/system32/Ebofz.dll (file missing)  
R3 - URLSearchHook: (no name) - \{777A067D-4011-4AF8-A862-6F90AA846768\} - C:/WINDOWS/system32/Dwoaem.dll (file missing)  
R3 - URLSearchHook: (no name) - \{0FAB0ABE-5538-4F73-9413-A7B004F28CE5\} - C:/WINDOWS/system32/Cjxl.dll (file missing)  
R3 - URLSearchHook: (no name) - \{9AA75677-9EC8-4C93-A03B-AEF4BBA47DEF\} - C:/WINDOWS/system32/Pfzd.dll (file missing)  
R3 - URLSearchHook: (no name) - \{2CE8A22A-F345-4535-BAC4-AD6CA18925E6\} - C:/WINDOWS/system32/Joiu.dll (file missing)  
R3 - URLSearchHook: (no name) - \{BDAE40AF-1B93-40A7-8AA9-941CE8478922\} - C:/WINDOWS/system32/Vrlr.dll (file missing)  
R3 - URLSearchHook: (no name) - \{0C4A6F76-F697-4C59-80F3-910344785973\} - C:/WINDOWS/system32/Cfxmvw.dll (file missing)  
R3 - URLSearchHook: (no name) - \{AFC8634F-F67A-4F88-B950-54DBCE59D322\} - C:/WINDOWS/system32/Nmgkm.dll (file missing)  
R3 - URLSearchHook: (no name) - \{8F1A07AE-48FD-4D67-B9CA-0418A9C093D6\} - C:/WINDOWS/system32/Alihs.dll (file missing)  
R3 - URLSearchHook: (no name) - \{8A953AE5-B4CC-4691-BAA7-078F533B2B55\} - C:/WINDOWS/system32/Bbuh.dll (file missing)  
R3 - URLSearchHook: (no name) - \{5EE40808-B4AD-423B-94E5-D027AE6D6955\} - C:/WINDOWS/system32/Yrnam.dll (file missing)  
R3 - URLSearchHook: (no name) - \{FA1B1592-BE49-4036-8E17-5E004063BD7C\} - C:/WINDOWS/system32/Jvvvfb.dll (file missing)  
R3 - URLSearchHook: (no name) - \{8F25AF6B-6BD7-477A-8E4C-B7BCBC4027E1\} - C:/WINDOWS/system32/Nagi.dll (file missing)  
R3 - URLSearchHook: (no name) - \{0B5E2FA7-CD00-435E-8D5D-CC801A3024F1\} - C:/WINDOWS/system32/Rmrb.dll (file missing)  
R3 - URLSearchHook: (no name) - \{3017565E-3424-4F08-BCD6-954553524E92\} - C:/WINDOWS/system32/Zduiq.dll (file missing)  
R3 - URLSearchHook: (no name) - \{24011B59-F75B-4894-8324-D60F4D4D4AC4\} - C:/WINDOWS/system32/Itjfge.dll (file missing)  
R3 - URLSearchHook: (no name) - \{09418925-370C-4806-A5AC-F35554AA4190\} - C:/WINDOWS/system32/Jwqk.dll (file missing)  
R3 - URLSearchHook: (no name) - \{E354B57E-E92C-4168-912A-92FBA3F06E7A\} - C:/WINDOWS/system32/Wxqk.dll (file missing)  
R3 - URLSearchHook: (no name) - \{7026FA9A-2ACC-41A0-BFA5-F401BDB8A28E\} - C:/WINDOWS/system32/Irhibw.dll (file missing)  
R3 - URLSearchHook: (no name) - \{D318DD44-FB1E-4CBF-85A4-F868AFE5505C\} - C:/WINDOWS/system32/Aahk.dll (file missing)  
O2 - BHO: internet explorer helper - \{02C9B9AB-6372-46C5-B356-773FAF3B6B1E\} - C:/WINDOWS/fonts/msshapi.dll (file missing)  
O2 - BHO: (no name) - \{0314B9FB-5711-49D8-AA91-51DA09E0E725\} - C:/WINDOWS/system32/Enkjvz.dll (file missing)

O2 - BHO: (no name) - \{074C1100-60FC-447C-AABA-721645DC8B45\} - C:/WINDOWS/system32/Fgrsc.dll (file missing)

O2 - BHO: MonitorURL Class - \{08A312BB-5409-49FC-9347-54BB7D069AC6\} - C:/PROGRA~1/DESKAD~1/deskipn.dll

O2 - BHO: (no name) - \{09418925-370C-4806-A5AC-F35554AA4190\} - C:/WINDOWS/system32/Jwqk.dll (file missing)  
O2 - BHO: (no name) - \{0A476BEF-93D7-4042-864A-43A9F6D00825\} - C:/WINDOWS/system32/Qksjd.dll (file missing)  
O2 - BHO: (no name) - \{0B5E2FA7-CD00-435E-8D5D-CC801A3024F1\} - C:/WINDOWS/system32/Rmrb.dll (file missing)  
O2 - BHO: (no name) - \{0C4A6F76-F697-4C59-80F3-910344785973\} - C:/WINDOWS/system32/Cfxmvw.dll (file missing)  
O2 - BHO: (no name) - \{0C7C23EF-A848-485B-873C-0ED954731014\} - (no file)  
O2 - BHO: wmpdrm - \{0E674588-66B7-4E19-9D0E-2053B800F69F\} - C:/WINDOWS/system32/wmpdrm.dll (file missing)  
O2 - BHO: (no name) - \{0F23A638-9C94-4280-AB81-D112B52D8C72\} - C:/WINDOWS/system32/Zptw.dll  
O2 - BHO: (no name) - \{0FAB0ABE-5538-4F73-9413-A7B004F28CE5\} - C:/WINDOWS/system32/Cjxl.dll (file missing)  
O2 - BHO: MyIEHelper Class - \{16B770A0-0E87-4278-B748-2460D64A8386\} - C:/Documents and Settings/All Users/Application Data/Microsoft/IEHelper/IEHelper\_5001.dll  
O2 - BHO: (no name) - \{1FA33C54-8DBB-4655-968B-8D76C85012EB\} - C:/WINDOWS/system32/Btim.dll (file missing)  
O2 - BHO: (no name) - \{2280D518-EAFC-4E5F-8137-95459A65E71D\} - C:/WINDOWS/system32/Bktql.dll (file missing)  
O2 - BHO: (no name) - \{24011B59-F75B-4894-8324-D60F4D4D4AC4\} - C:/WINDOWS/system32/Itjfge.dll (file missing)  
O2 - BHO: WinSearch - \{27E96DE0-8211-42CF-9A1E-FA6246A95B77\} - C:/WINDOWS/system32/winsearch.dll  
O2 - BHO: (no name) - \{2CE8A22A-F345-4535-BAC4-AD6CA18925E6\} - C:/WINDOWS/system32/Joiu.dll (file missing)  
O2 - BHO: (no name) - \{3017565E-3424-4F08-BCD6-954553524E92\} - C:/WINDOWS/system32/Zduiq.dll (file missing)  
O2 - BHO: (no name) - \{47A5977B-52FB-46EC-9C79-C5694A1A0499\} - C:/WINDOWS/system32/Dhsix.dll (file missing)  
O2 - BHO: (no name) - \{4FEE26D2-50EA-452C-AA9C-7FE89EED2014\} - C:/WINDOWS/system32/Ebofz.dll (file missing)  
O2 - BHO: (no name) - \{53D94615-275A-4F4B-93C5-600355C452F8\} - C:/WINDOWS/system32/Llkd.dll (file missing)

O2 - BHO: (no name) - \{57D87E3D-F83A-48C7-9883-9E4AEF4E3C4E\} - C:/WINDOWS/system32/Uilnhk.dll (file missing)  
O2 - BHO: (no name) - \{59172C14-06B4-40C8-9A95-BC71C73BF5AF\} - C:/WINDOWS/system32/Ivaeye.dll (file missing)  
O2 - BHO: (no name) - \{5B83669A-3EF7-4E7D-ACC0-2DE10FAF1D8E\} - C:/WINDOWS/system32/Fxai.dll (file missing)  
O2 - BHO: CdnForIE Class - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll  
O2 - BHO: (no name) - \{5EE40808-B4AD-423B-94E5-D027AE6D6955\} - C:/WINDOWS/system32/Yrnam.dll (file missing)  
O2 - BHO: Vision - \{6671A431-5C3D-463d-A7CF-5587F9B7E191\} - C:/PROGRA~1/MMSASS~1/mmsass~1.dll  
O2 - BHO: stdup - \{6A512BF7-EC78-4e8d-9841-6C02E8FA9838\} - C:/WINDOWS/System32/stdup.dll  
O2 - BHO: (no name) - \{7026FA9A-2ACC-41A0-BFA5-F401BDB8A28E\} - C:/WINDOWS/system32/Irhibw.dll (file missing)  
O2 - BHO: (no name) - \{717BB5F3-D783-44AD-A672-FBE9FF014212\} - C:/WINDOWS/system32/Jzwz.dll (file missing)  
O2 - BHO: (no name) - \{777A067D-4011-4AF8-A862-6F90AA846768\} - C:/WINDOWS/system32/Dwoaem.dll (file missing)  
O2 - BHO: CpapView Class - \{77962960-536E-47EC-9DDB-52651519705F\} - C:/WINDOWS/system32/rundll32.dll (file missing)  
O2 - BHO: (no name) - \{7A68C18B-5050-49A1-89A2-EC2A4C9AD4D4\} - C:/WINDOWS/system32/Aseuxe.dll (file missing)  
O2 - BHO: (no name) - \{808B6AF8-F101-4AF7-AC49-98D403B16FBA\} - C:/WINDOWS/system32/Uhxwtr.dll (file missing)  
O2 - BHO: (no name) - \{8446B2EE-C04C-4C5D-9706-2FFB46E89B62\} - C:/WINDOWS/system32/Mihu.dll  
O2 - BHO: (no name) - \{8A953AE5-B4CC-4691-BAA7-078F533B2B55\} - C:/WINDOWS/system32/Bbuh.dll (file missing)  
O2 - BHO: (no name) - \{8F1A07AE-48FD-4D67-B9CA-0418A9C093D6\} - C:/WINDOWS/system32/Alihs.dll (file missing)  
O2 - BHO: (no name) - \{8F25AF6B-6BD7-477A-8E4C-B7BCBC4027E1\} - C:/WINDOWS/system32/Nagi.dll (file missing)  
O2 - BHO: (no name) - \{9AA75677-9EC8-4C93-A03B-AEF4BBA47DEF\} - C:/WINDOWS/system32/Pfzd.dll (file missing)  
O2 - BHO: (no name) - \{9CF077C6-E3CE-435B-B6EF-9ED2308051EA\} - C:/WINDOWS/system32/Kmdlim.dll (file missing)  
O2 - BHO: (no name) - \{9D0E044F-4C70-4AE0-99CE-DC3C730C6AD5\} - C:/WINDOWS/system32/Tpuwa.dll (file missing)  
O2 - BHO: Yahoo Bar - \{A697BC46-BC93-4833-93F5-1E365011E88A\} - C:/WINDOWS/ODBINT.dll  
O2 - BHO: Java Enhancer - \{AF098F95-7CEA-407A-8552-3846737CC4B2\} - C:/WINDOWS/system32/funcwin.dll  
O2 - BHO: (no name) - \{AFC8634F-F67A-4F88-B950-54DBCE59D322\} - C:/WINDOWS/system32/Nmgkm.dll (file missing)  
O2 - BHO: (no name) - \{B864F7E0-8EC6-4F40-A5D2-6DF6E7218916\} - C:/WINDOWS/system32/Xnskic.dll (file missing)  
O2 - BHO: Flash 8 ocx - \{B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD\} - C:/WINDOWS/system32/flash8.dll  
O2 - BHO: (no name) - \{BDAE40AF-1B93-40A7-8AA9-941CE8478922\} - C:/WINDOWS/system32/Vrlr.dll (file missing)  
O2 - BHO: (no name) - \{BFCD2BAD-DE01-433E-A751-731B77EF84AD\} - C:/WINDOWS/system32/Zzwcrh.dll (file missing)  
O2 - BHO: Count Class - \{CFF6E0CF-02FB-47F5-95A4-DD8610D59284\} - C:/WINDOWS/system32/bsnviewer.dll  
O2 - BHO: 51导航 - \{D271A289-57EB-4D0E-9131-A0CD25D4D1F8\} - C:/WINDOWS/system32/browsewmzero.dll  
O2 - BHO: (no name) - \{D318DD44-FB1E-4CBF-85A4-F868AFE5505C\} - C:/WINDOWS/system32/Aahk.dll (file missing)  
O2 - BHO: (no name) - \{DB020387-4489-4B9B-AF88-1AF9357CAA18\} - C:/WINDOWS/system32/Paiy.dll  
O2 - BHO: (no name) - \{E238864E-8FC0-4964-A119-8C219FD3FCA5\} - C:/WINDOWS/system32/Qgungz.dll (file missing)  
O2 - BHO: (no name) - \{E354B57E-E92C-4168-912A-92FBA3F06E7A\} - C:/WINDOWS/system32/Wxqk.dll (file missing)  
O2 - BHO: (no name) - \{E68EF228-54B9-4F82-96F3-55DDBE3855FE\} - C:/WINDOWS/system32/Wqonu.dll  
O2 - BHO: (no name) - \{EB6E4937-8C1D-4422-A928-A955BF4050A5\} - C:/WINDOWS/system32/Gmuseq.dll (file missing)  
O2 - BHO: update wnwb - \{ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270\} - C:/PROGRA~1/COMMON~1/Wnwb/wnwbio.dll  
O2 - BHO: (no name) - \{F3E2FC60-FB25-4050-8F98-6DC54343E838\} - C:/WINDOWS/system32/Lrfpy.dll (file missing)  
O2 - BHO: WMHlprObj Class - \{F5824EFB-728A-4726-A5A5-85A68B20EDC3\} - C:/PROGRA~1/CNNIC/Cdn/wmhlpr.dll  
O2 - BHO: (no name) - \{FA1B1592-BE49-4036-8E17-5E004063BD7C\} - C:/WINDOWS/system32/Jvvvfb.dll (file missing)  
O3 - Toolbar: CopySo拷贝搜 - \{40987A5C-6AB8-4977-8BE9-A8889DE2EDCC\} - C:/Program Files/Copyso/CopysoIE.dll (file missing)  
O3 - Toolbar: (no name) - \{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C\} - (no file)

O4 - HKLM/../Run: \[CdnCtr\] C:/Program Files/CNNIC/Cdn/cdnup.exe  
O4 - HKLM/../Run: \[Desktop\] C:/WINDOWS/system32/rundll32.exe "C:/Program Files/DeskAdTop/Run.dll" ,Rundll  
O4 - HKLM/../Run: \[spoolsv\] C:/WINDOWS/system32/spoolsv/spoolsv.exe -printer  
O8 - Extra context menu item: >>彩信发送<< - res://C:/PROGRA~1/MMSASS~1/mmsass~1.dll/mms.htm  
O8 - Extra context menu item: 访问通用网址 - C:/Program Files/CNNIC/Cdn/cnnic.htm  
O9 - Extra button: 中文上网 - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll  
O9 - Extra 'Tools' menuitem: 中文上网 - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll  
O9 - Extra button: (no name) - \{6671A433-5C3D-463d-A7CF-5587F9B7E191\} - C:/PROGRA~1/MMSASS~1/mmsass~1.dll  
O9 - Extra 'Tools' menuitem: 彩E精灵设置 - \{6671A433-5C3D-463d-A7CF-5587F9B7E191\} - C:/PROGRA~1/MMSASS~1/mmsass~1.dll

O10 - Unknown file in Winsock LSP: c:/windows/system32/cdnns.dll  
O11 - Options group: \[CDNCLIENT\] 中文上网

O21 - SSODL: webwork - \{4C611512-2C1D-44b2-A044-872AD2AD5A61\} - C:/WINDOWS/webwork/webwork.dll

O23 - Service: ebook (ebooK) - Unknown owner - C:/WINDOWS/exe  
\---------/

卸载：Vision，stdup，webwork，winsearch，中文上网，桌面媒体（DeskAdTop）

停止并禁用服务：ebook (ebooK)

用 WinRAR找到文件：C:/WINDOWS/exe，居然不能打包。晕！

到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载 IceSword，把 C:/WINDOWS/exe 复制到桌面，可以打包备份了。  
但用 IceSword 也无法删除C:/WINDOWS/exe，晕！

到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载 下次启动时自动删除文件程序/Auto\_Del 并运行，把 C:/WINDOWS/exe 从WinRAR 窗口拖到 下次启动时自动删除文件 窗口，提示 文件不存在或者是文件夹，点确定把 C:/WINDOWS/exe 加入待删文件列表，点下次启动时删除按钮。瑞星提示 Auto\_Del.exe 要修改注册表，允许并确认。

关闭所有文件夹窗口，用HijackThis扫描并修复上面所列项目。

清空IE临时文件夹

Kaspersky 将 C:/WINDOWS/exe 报为 **Backdoor.Win32.Hupigon.cda**。

[http_endurer.ys168.com]: http://endurer.ys168.com