5c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,5c,\
00,31,00,00,00,00,00,3a,31,09,3c,10,00,44,4f,43,55,4d,45,7e,31,\
00,00,44,00,03,00,04,00,ef,be,3a,31,9c,36,2a,35,f7,29,14,00,00,\
00,44,00,6f,00,63,00,75,00,6d,00,65,00,6e,00,74,00,73,00,20,00,\
61,00,6e,00,64,00,20,00,53,00,65,00,74,00,74,00,69,00,6e,00,67,\
00,73,00,00,00,18,00,4c,00,31,00,00,00,00,00,2a,35,cb,2e,16,00,\
4e,45,54,57,4f,52,7e,31,00,00,34,00,03,00,04,00,ef,be,3a,31,11,\
39,2a,35,cb,2e,14,00,00,00,4e,00,65,00,74,00,77,00,6f,00,72,00,\
6b,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00,18,00,56,\
00,31,00,00,00,00,00,2a,35,cb,2e,11,00,46,41,56,4f,52,49,7e,31,\
00,00,3e,00,03,00,04,00,ef,be,2a,35,cb,2e,2a,35,cb,2e,14,00,28,\
00,46,00,61,00,76,00,6f,00,72,00,69,00,74,00,65,00,73,00,00,00,\
40,73,68,65,6c,6c,33,32,2e,64,6c,6c,2c,2d,31,32,36,39,33,00,18,\
00,30,00,35,00,00,00,00,00,2a,35,f1,2e,10,00,fe,94,a5,63,00,00,\
1c,00,03,00,04,00,ef,be,2a,35,f1,2e,2a,35,f1,2e,14,00,00,00,fe,\
94,a5,63,00,00,14,00,00,00,60,00,00,00,03,00,00,a0,58,00,00,00,\
00,00,00,00,6c,69,6e,62,61,6f,68,65,00,00,00,00,00,00,00,00,1e,\
8c,63,4d,34,72,b3,48,8a,de,83,67,8f,38,be,10,b1,a9,fd,89,90,40,\
db,11,b2,29,00,d0,59,c0,b8,59,1e,8c,63,4d,34,72,b3,48,8a,de,83,\
67,8f,38,be,10,b1,a9,fd,89,90,40,db,11,b2,29,00,d0,59,c0,b8,59,\
00,00,00,00
5、在HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
添加："Settings"=hex:0c,00,02,00,0a,01,ef,75,60,00,00,00
6、在HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\
添加：
{0055C089-8582-441B-A0BF-17B458C2A3A8}
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
{92780B25-18CC-41C8-B9BE-3C9C571A8263}
{AE7CD045-E861-484F-8273-0445EE161910}
{DEDEB80D-FA35-45D9-9460-4983E5A8AFE6}
{FB5F1910-F110-11D2-BB9E-00C04F795683}
7、在HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\链接
添加："Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00

三、进行上述观察后，重启系统。
重启后，卡巴斯基报警（我的卡巴斯基为启动加载）：发现灰鸽子。但卡巴斯基仅仅将c:\windows\winlogon.dll删除；c:\windows\winlogon.exe和c:\windows\winlogonKey.dll卡巴斯基并不报毒。汗！！卡巴斯基越来越不争气了，另外发现其winlogonKey.log文件。
四、查杀流程：
1、打开注册表编辑器，展开HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
删除灰鸽子的服务项：winlogon.exe
2、重启系统。用IceSword找到并删除鸽子释放的那三个文件。
4、清理注册表（删除鸽子添加的注册表项）。