急!!出现多个IEXPLORE.EXE进程,占用内存,是什么病毒?(有日志) bbs.ikaka.com

rianna - 2006-8-28 10:22:00

系统一开机,没有打开网页就出现多个IEXPLORE.EXE(大写)进程,而且不断增加,终止进程后,一段时间又出现很多IEXPLORE.EXE进程,机器变得很慢,这是什么病毒,应该怎么杀?......急.

对了.同时伴有IEXPLORE.EXE应用程序错误的报错,而且我用的浏览器是greenbrowser,根本没有开ie,后来又发现如果这个进程IEXPLORE.EXE太多没有关,网速也很慢,基本不能上网了,终止之后又能顺利上网了.

我在网上搜了关于类似的问题,有的说是灰鸽子,但我觉得症状不是特别吻合, 注册表中找不到那些文件,.还有说是Trojan.PowerSpider.ac,但这个病毒进程是小写的iexplore.exe啊,我是大写的.然后又怀疑是iexpl0re.exe,就是中间那个不是字母o,而是数字零,但是他的症状是只出现一个,好像也不是.后来在百度知道上看到有人描述的症状跟我很像,下面的答案是中的是最新版本,处理方法如下

"现在地杀毒软件还没有能处理这个地!楼上说的都是废话你中的是最新版本！以下是我的处理办法！
如果你刚刚开机没开网页就发现自动运行了个iexplore.exe恭喜你大概是个木马
网上至今还没有完全解决办法，我刚刚简单处理了一下，如果你的症状和我一样你可以在 c:\windows\system32\com\下面找到一个隐藏者的全名只为com的文件，先别管他现在还删不掉，先打开管理工具里的服务列表你应该发现一个和你防火墙大致同名的服务,最后以"2006"结尾，找到他关闭它然后再找注册表HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services里把和那个服务同名的子菜单删除然后重启机器现在那个COM文件可以删除了以后都不会自动运行iexplore.exe了"

但我根本找不到他的那个全名为com的文件,后面的好像也找不到和我防火墙大致同名的服务,我防火墙用的卡巴斯基.

我又用process explorer看这个进程,他的路径是C:\Program Files\Internet Explorer\IEXPLORE.EXE,命令行是"C:\Program Files\Internet Explorer\IEXPLORE.EXE",上级services.exe(836),用户是NT AUTHORITY\SYSTEM.我不懂电脑,所以觉得这好像就是正常的系统的ie,只是不知什么原因开了好多个,占用我的内存...其他的却好像没什么明显异常情况.

55555555555555555..我已经尽力做了很多功课了,可是实在是搞不定这个病毒,只好向各位高手求助了..多谢啊

有毒必问 - 2006-8-28 10:27:00

下个HijackThis v1.99.1,搞个日志上来

rianna - 2006-8-28 10:35:00

是这个吗?

Logfile of HijackThis v1.99.1
Scan saved at 10:25:20, on 2006-8-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\Program Files\GreenBrowserGB_0323\GreenBrowser.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\桌面\ha_hijackthis_1991\HijackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [kis] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: Web反病毒保护 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B2B71E9C-7328-4336-B802-F939D2E86E1D}: NameServer = 202.96.209.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: 卡巴斯基互联网安全套装 6.0 (AVP) - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

rianna - 2006-8-28 10:36:00

我在安全模式下杀过毒的,但是没有杀出来

mgh2005 - 2006-8-28 10:36:00

完了~~
你电脑注定要痛苦后半生了~~
这个病毒现在还没解药的~~~~~~~~~~~~

newcenturymoon - 2006-8-28 10:40:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

rianna - 2006-8-28 10:46:00

4楼的你别吓我啊..我都重装过系统了,还没好...5555555

这是System Repair Engineer扫描出来的日志
2006-08-28,10:36:22

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<msnmsgr><"C:\Program Files\MSN Messenger\msnmsgr.exe" /background> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<kis><"D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<9><C:\WINDOWS\system32\Ravdm.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><D:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
<WinlogonNotify: AtiExtEvent><Ati2evxx.dll> [ATI Technologies Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><>
[卡巴斯基互联网安全套装 6.0 / AVP]
<"D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[ForceWare Intelligent Application Manager (IAM) / ForceWare Intelligent Application Manager (IAM)]
<C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe><>
[Forceware Web Interface / ForcewareWebInterface]
<"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice><Apache Software Foundation>
[ForceWare IP service / nSvcIp]
<C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe><NVIDIA>
[ForceWare user log service / nSvcLog]
<C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe><NVIDIA>

==================================
浏览器加载项
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Java Plug-in]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in]
{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_06]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll, Sun Microsystems, Inc.>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\flash.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

rianna - 2006-8-28 10:49:00

==================================
正在运行的进程
[PID: 676][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 756][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 792][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\Ati2evxx.dll] <ATI Technologies Inc.><6.14.10.4118>
[C:\WINDOWS\system32\klogon.dll] <Kaspersky Lab><6.0.0.299>
[PID: 836][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 848][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 992][C:\WINDOWS\system32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4118>
[C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2497>
[PID: 1020][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1076][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[PID: 1188][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[PID: 1324][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[PID: 1440][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1596][C:\WINDOWS\system32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4118>
[C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2497>
[PID: 1688][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll] <><1, 0, 0, 1>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll] <Kaspersky Lab><6.0.0.299>
[d:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[PID: 1928][D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\FSSync.dll] <Kaspersky Lab><6.0.5.0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\AVPGS.PPL] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\winreg.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\avpgui.ppl] <Kaspersky Lab><6.0.0.300>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\basegui.dll] <Kaspersky Lab><6.0.0.300>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\thpimpl.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\qb.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\inflate.ppl] <Kaspersky Lab><6.0.0.16>
[PID: 1936][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1988][D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\FSSync.dll] <Kaspersky Lab><6.0.5.0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\AVPGS.PPL] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\winreg.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tm.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\bl.ppl] <Kaspersky Lab><6.0.0.300>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\wmihlpr.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\ndetect.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\crpthlpr.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\schedule.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\timer.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\thpimpl.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\lic60.ppl] <Kaspersky Lab><6.0.0.300>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\report.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\hashmd5.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\avs.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\avpmgr.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\wdiskio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\avlib.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\avspm.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\avp3info.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\ahids.ppl] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\CKAHUM.dll] <Kaspersky Lab><6.0.0.1>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\CKAHComm.dll] <Kaspersky Lab><6.0.0.1>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ckahrule.dll] <Kaspersky Lab><6.0.0.1>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\adialtsk.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\ahfw.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\antispam.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\aphisht.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\popupchk.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\og.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\sfdb.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pdm.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\resip.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\sc.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\httpscan.ppl] <Kaspersky Lab><6.0.0.299>

rianna - 2006-8-28 10:50:00

[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klaveng.dll] <N/A><N/A>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\mc.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\smtpprotocoller.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\httpanlz.ppl] <Kaspersky Lab><6.0.0.300>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\oas.ppl] <Kaspersky Lab><6.0.0.300>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\procmon.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\dtreg.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pop3protocoller.ppl] <Kaspersky Lab><6.0.0.300>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\aphish.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\prutil.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\trafficmonitor2.ppl] <N/A><N/A>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\maildisp.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\avp1.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\imapprotocoller.ppl] <Kaspersky Lab><6.0.0.300>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\l_llio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nntpprotocoller.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\ichk2.ppl] <Kaspersky Lab><6.0.0.300>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\icheckersa.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\hashcont.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\hccmp.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\iwgen.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\uniarc.ppl] <Kaspersky Lab><6.0.0.16>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\minizip.ppl] <Kaspersky Lab><6.0.0.16>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\cab.ppl] <Kaspersky Lab><6.0.0.16>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\arj.ppl] <Kaspersky Lab><6.0.0.16>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\rar.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\lha.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\mdb.ppl] <Kaspersky Lab><6.0.0.300>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\msoe.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\ods.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\buffer.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\memscan.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\memmodsc.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\ntfsstrm.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\btdisk.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\startupenum2.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\inifile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\btimages.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\qb.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\prseqio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\inflate.ppl] <Kaspersky Lab><6.0.0.16>
[PID: 2024][C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe] <Apache Software Foundation><2.0.52>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libapr.dll] <Apache Software Foundation><0.0.0.0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libaprutil.dll] <Apache Software Foundation><0.0.0.0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libapriconv.dll] <Apache Software Foundation><0.0.0.0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libhttpd.dll] <Apache Software Foundation><2.0.52>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_access.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_actions.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_alias.so] <Apache Software Foundation><2.0.49>

rianna - 2006-8-28 10:51:00

[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_asis.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_auth.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_autoindex.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_cgi.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_dir.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_env.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_expires.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_headers.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_imap.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_include.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_isapi.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_log_config.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_mime.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_negotiation.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_rewrite.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_setenvif.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_ssl.so] <Apache Software Foundation><2.0.47>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\SSLEAY32.dll] <N/A><N/A>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\LIBEAY32.dll] <N/A><N/A>
[PID: 252][C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe] <NVIDIA><2, 2, 0, 464>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nv_common.dll] <NVIDIA><2, 2, 0, 464>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nv_common_firewall.dll] <NVIDIA><2, 2, 0, 464>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\NMI.dll] <NVIDIA Corporation><2, 2, 0, 464>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\SpecialCase.dll] <NVIDIA><2, 2, 0, 464>
[PID: 324][C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe] <NVIDIA><2, 2, 0, 464>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nv_common.dll] <NVIDIA><2, 2, 0, 464>
[PID: 576][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 692][C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe] <><1, 0, 1, 0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\NMI.dll] <NVIDIA Corporation><2, 2, 0, 464>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nv_common.dll] <NVIDIA><2, 2, 0, 464>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nv_resource_L1033.dll] <NVIDIA Corporation><1, 0, 1, 0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\AppFltUi.dll] <NVIDIA Corporation><>
[PID: 716][C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe] <Apache Software Foundation><2.0.52>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libapr.dll] <Apache Software Foundation><0.0.0.0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libaprutil.dll] <Apache Software Foundation><0.0.0.0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libapriconv.dll] <Apache Software Foundation><0.0.0.0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libhttpd.dll] <Apache Software Foundation><2.0.52>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_access.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_actions.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_alias.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_asis.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_auth.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_autoindex.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_cgi.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_dir.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_env.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_expires.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_headers.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_imap.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_include.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_isapi.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_log_config.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_mime.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_negotiation.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_rewrite.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_setenvif.so] <Apache Software Foundation><2.0.49>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_ssl.so] <Apache Software Foundation><2.0.47>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\SSLEAY32.dll] <N/A><N/A>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\LIBEAY32.dll] <N/A><N/A>
[PID: 2548][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[PID: 3028][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[PID: 2716][D:\Program Files\GreenBrowserGB_0323\GreenBrowser.exe] <MoreQuick><1, 0, 0, 0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>

mgh2005 - 2006-8-28 10:52:00

没吓你的
真的
我也中了
搞几天了
好痛苦呀~~~~~~~~~~

rianna - 2006-8-28 10:52:00

[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045>
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] <Macromedia, Inc.><8,0,22,0>
[C:\WINDOWS\system32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 180][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3020][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1228][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll] <Sun Microsystems, Inc.><5.0.60.5>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 1392][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll] <Sun Microsystems, Inc.><5.0.60.5>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 3068][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll] <Sun Microsystems, Inc.><5.0.60.5>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 4260][C:\WINDOWS\system32\wbem\wmiprvse.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nmp.dll] <NVIDIA Corporation><2, 2, 0, 464>
[C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nv_common.dll] <NVIDIA><2, 2, 0, 464>
[PID: 1784][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll] <Sun Microsystems, Inc.><5.0.60.5>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 276][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll] <Sun Microsystems, Inc.><5.0.60.5>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>

rianna - 2006-8-28 10:52:00

[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 288][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll] <Sun Microsystems, Inc.><5.0.60.5>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 3344][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll] <Sun Microsystems, Inc.><5.0.60.5>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 2996][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll] <Sun Microsystems, Inc.><5.0.60.5>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 280][C:\Documents and Settings\Administrator\桌面\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\nvappfilter.dll] <NVIDIA><1, 0, 2, 0>
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

一个字都没敢改,高手帮帮看看吧..

rianna - 2006-8-28 11:03:00

那你现在怎么办啊

mgh2005 - 2006-8-28 11:04:00

没办法了等待高人解救了~~~~~~~~

rianna - 2006-8-28 11:06:00

高人高人,快出现啊..

mgh2005 - 2006-8-28 11:11:00

哎~我也没法子呀~
痛苦中呢~
只能求助高人出手了~~~~~~~~

rianna - 2006-8-28 11:53:00

ls的我看到你的帖子了,果然和我很像,帮你顶了,希望能找到解决方法

brvoe - 2006-8-28 11:58:00

这几天我也搞这个病毒，网上是没什么解法，病毒十分狡猾，看起来是灰鸽子的变种，通过调用IEXPLORE.exe自动下载种类很多的木马到机器上，大部分可以被杀软拦截。你看你的winnt\temp 和Documents and Settings\用户名\Local Settings\temp下有无win****(名字随机）.exe，大小232k的文件，这种卡巴不报警，如果你开咔吧主动防御的话，清除后再次被感染时咔吧提示未知病毒。这种病毒最烦人的是下载的多种病毒，很多也是加载IEXPLORE进程的，搞的不容易分析最终是什么病毒。
不知道你中的到底是不是这种

newcenturymoon - 2006-8-28 12:00:00

请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931，下载，LSPFix.exe，WinsockXPFix这两个软件
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

运行LSPFix.exe
删除
nvappfilter.dll附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时，请关闭所有IE界面和文件夹界面后运行LSPFix，运行后，把要修复的那一个O10项从左边转到右边，点“Finish”即可。（不过这之前，需要在“I know what I`m doing”前面打勾。）
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
c:\windows\system32\nvappfilter.dll修复后重启，如果无法上网，请运行WinsockXPFix，让它修复一下。

rianna - 2006-8-28 12:16:00

谢谢18楼的,我在这个temp文件夹里没搜到.exe的文件,我上网几个小时看卡巴斯基只拦截到一个木马,但我觉得你说的很有道理,因为IEXPLORE.EXE进程一多,网速就慢,可能就是下载的原因.

19楼的方法,我努力试一试哦,试好了把结果贴上来..谢谢了.

rianna - 2006-8-28 12:31:00

我前面都弄好了,但是删nvappfilter.dll时,说磁盘未满或未写保护而且文件未被使用..删不掉啊

菜鸟Lee - 2006-8-28 12:35:00

我有个愚蠢地办法，相信我的话你可以试试◎_◎，你就用防火墙永远不让IE连接网络，然后用别的浏览器上网，我是用TT上的TT以IE为内核的，现在你的IE不能上网，那个木马也不能利用IE下载木马，传送密码，但你的TT还是可以上网的。。。（愚蠢地办法）我也是中了那个木马的，该死的QQ系统消息网站也有木马NND BS黑客

rianna - 2006-8-28 12:41:00

我用的greenbrower是用ie做为核心的,ie不能上,ms这个greenbrower也不能上了

brvoe - 2006-8-28 12:48:00

我说下我的方法，我不是专业人士，不一定适用。
这种病毒狡猾的地方是感染文件和正常的win程序名字没任何区别，svchost就是svchost,IEXPLORE就是IEXPLORE，这样我怀疑是每次启动后就感染正常的IEXPLORE程序，然后病毒就隐藏不动（打死也不动），这样杀软查不出，其后利用感染的IEXPLORE程序下栽别的木马，这样杀软只查出一些替罪羊，真正的“教唆犯罪者”隐藏幕后。
目前想的方法就是我先删除IEXPLORE.exe，让此病毒无法感染，这样病毒一直保持活动性，杀软就可查出。步骤是：
1、安全模式下，查杀病毒，（此病毒比较特殊，未必能查出，不要紧）。
2、删除program filie/internet explorer/iexplore.exe(放回收站，不要彻底删除）
3、正常启动，查杀病毒，一般的杀软应该就查出了，估计在system32里。
4、记下病毒名，（我的是一个netmyjs.exe文件）。应该是个exe文件，运行注册表，查找病毒名，删除相关键值。
5、打开服务，根据刚才病毒名，果然开了个后门，禁用此项服务
6、恢复回收站里iexplore.exe文件。
此步骤完成后，发现每过30分钟左右，仍有病毒下栽，但数量大大减少，只有一个，每次都被ewido拦截，病毒名trojan.agent.hw，好象新变种。
此时怀疑还有1个“幕后教唆犯”，另一个估计是隐藏服务。
用冰刃监控，无发现，用winpatrol,发现服务svchost，和正常程序文件名没不同，唯一的不同是在winnt目录下和temp，正常的应该是winnt\system32下，好了，此项服务禁用，然后搜索，除了winnt\system32下的，其他全部删除，然后查注册表，路径非winnt\system32下的 svchost键值，（注意，名字完全一样，容易看花眼的）。在过程中,winpatrol要一直开着，因为会再次加服务的，提示加服务就阻止。
最后补充，清除过程可能需重复多次。

瑞星卡卡安全论坛