瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 急!!出现多个IEXPLORE.EXE进程,占用内存,是什么病毒?(有日志)

12345678»   2  /  10  页   跳转

急!!出现多个IEXPLORE.EXE进程,占用内存,是什么病毒?(有日志)

没吓你的
真的
我也中了
搞几天了
好痛苦呀~~~~~~~~~~
gototop
 

[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\WINDOWS\system32\Macromed\Flash\flash.ocx]  <Macromedia, Inc.><8,0,22,0>
    [C:\WINDOWS\system32\upengine.dll]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 180][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3020][C:\WINDOWS\system32\conime.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1228][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\nvappfilter.dll]  <NVIDIA><1, 0, 2, 0>
    [C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll]  <Sun Microsystems, Inc.><5.0.60.5>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  <Kaspersky Lab><1.0.6.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\Macromed\Flash\flash.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 1392][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll]  <Sun Microsystems, Inc.><5.0.60.5>
    [C:\WINDOWS\system32\nvappfilter.dll]  <NVIDIA><1, 0, 2, 0>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  <Kaspersky Lab><1.0.6.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\Macromed\Flash\flash.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 3068][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll]  <Sun Microsystems, Inc.><5.0.60.5>
    [C:\WINDOWS\system32\nvappfilter.dll]  <NVIDIA><1, 0, 2, 0>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  <Kaspersky Lab><1.0.6.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\Macromed\Flash\flash.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 4260][C:\WINDOWS\system32\wbem\wmiprvse.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nmp.dll]  <NVIDIA Corporation><2, 2, 0, 464>
    [C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nv_common.dll]  <NVIDIA><2, 2, 0, 464>
[PID: 1784][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\nvappfilter.dll]  <NVIDIA><1, 0, 2, 0>
    [C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll]  <Sun Microsystems, Inc.><5.0.60.5>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  <Kaspersky Lab><1.0.6.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\Macromed\Flash\flash.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 276][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll]  <Sun Microsystems, Inc.><5.0.60.5>
    [C:\WINDOWS\system32\nvappfilter.dll]  <NVIDIA><1, 0, 2, 0>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  <Kaspersky Lab><1.0.6.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  <Kaspersky Lab><6.0.0.299>
gototop
 

[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\Macromed\Flash\flash.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 288][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll]  <Sun Microsystems, Inc.><5.0.60.5>
    [C:\WINDOWS\system32\nvappfilter.dll]  <NVIDIA><1, 0, 2, 0>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  <Kaspersky Lab><1.0.6.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\Macromed\Flash\flash.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 3344][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll]  <Sun Microsystems, Inc.><5.0.60.5>
    [C:\WINDOWS\system32\nvappfilter.dll]  <NVIDIA><1, 0, 2, 0>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  <Kaspersky Lab><1.0.6.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\Macromed\Flash\flash.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 2996][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll]  <Sun Microsystems, Inc.><5.0.60.5>
    [C:\WINDOWS\system32\nvappfilter.dll]  <NVIDIA><1, 0, 2, 0>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  <Kaspersky Lab><1.0.6.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\Macromed\Flash\flash.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 280][C:\Documents and Settings\Administrator\桌面\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINDOWS\system32\nvappfilter.dll]  <NVIDIA><1, 0, 2, 0>
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  <Kaspersky Lab><6.0.0.299>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]


一个字都没敢改,高手帮帮看看吧..
gototop
 

那你现在怎么办啊
gototop
 

没办法了等待高人解救了~~~~~~~~
gototop
 

高人高人,快出现啊..
gototop
 

哎~我也没法子呀~
痛苦中呢~
只能求助高人出手了~~~~~~~~
gototop
 

ls的我看到你的帖子了,果然和我很像,帮你顶了,希望能找到解决方法
gototop
 

这几天我也搞这个病毒,网上是没什么解法,病毒十分狡猾,看起来是灰鸽子的变种,通过调用IEXPLORE.exe自动下载种类很多的木马到机器上,大部分可以被杀软拦截。你看你的winnt\temp 和Documents and Settings\用户名\Local Settings\temp下有无win****(名字随机).exe,大小232k的文件,这种卡巴不报警,如果你开咔吧主动防御的话,清除后再次被感染时咔吧提示未知病毒。这种病毒最烦人的是下载的多种病毒,很多也是加载IEXPLORE进程的,搞的不容易分析最终是什么病毒。
不知道你中的到底是不是这种
gototop
 

请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931,下载,LSPFix.exe,WinsockXPFix这两个软件
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

运行LSPFix.exe
删除
nvappfilter.dll附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时,请关闭所有IE界面和文件夹界面后运行LSPFix,运行后,把要修复的那一个O10项从左边转到右边,点“Finish”即可。(不过这之前,需要在“I know what I`m doing”前面打勾。)
双击我的电脑,工具,文件夹选项,查看,单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件(推荐)"复选框。在提示确定更改时,单击“是”,清除“隐藏已知文件类型的扩展名
删除
c:\windows\system32\nvappfilter.dll修复后重启,如果无法上网,请运行WinsockXPFix,让它修复一下。
gototop
 
12345678»   2  /  10  页   跳转
页面顶部
Powered by Discuz!NT