1   1  /  1  页   跳转

tfdjdeh.EXE是什么病毒啊?

tfdjdeh.EXE是什么病毒啊?

我的电脑在每天上午会出现这样一个问题:IE浏览器每隔一段时间会自动打开,然后在几秒钟之内又自动关闭。这个过程中,通常浏览器还没有完全启动,只能看见部分IE的工具栏。不过可以清楚的看见电脑把IE打开后,随后点击了“停止”按钮,之后是右击标题栏,选择了“关闭”项,这一连贯的动作间并没有时间间隔,是个连续的过程。一般的木马程序主要是弹出网页,并不会自动关闭,我不知道是什么问题。
另外,如果我手动先把浏览器打开,那通常过几分钟后它就会自动关闭。这种情况下的关闭是突然关闭,并不能看见我开始说的鼠标动作。
以上这些现象,只在上午10点之前出现。之后到晚上1、2点都不会出现这些问题,浏览器能使用正常。
10点之后这段时间,如果使用IE,它就会跳出一些网页,但不会出现IE自动关闭的情况。同时,如果我不使用IE,这些广告网页并不会自动跳出。
我用了卡巴斯基、3721、雅虎助手、超级兔子、ewido、优化大师、还有其他一些木马专杀工具和IE修复软件都不能找出问题。均显示无毒。安全模式下也不能发现病毒。在任务管理器里面能看见多个rundll32.exe 用户进程和一个rundll32.exe 系统进程。rundll32.exe 用户进程强行关闭后,它会随即出现一个新的rundll32.exe 用户进程。
最后编辑2007-03-02 13:09:18
分享到:
gototop
 

问题补充:Running processes:
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\SYSTEM32\MRCARD.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system\MsNetEx.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ipdcl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\zieninl.exe
gototop
 

那位高手知道这个是什么问题啊
gototop
 

Logfile of HijackThis v1.99.1
Scan saved at 13:05:39, on 2007-3-2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\IPMsg\ipmsg.exe
C:\WINDOWS\SYSTEM32\MRCARD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ipdcl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AutoCAD 2004\acad.exe
C:\DOCUME~1\zqr\LOCALS~1\Temp\~e5d141.tmp
C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe
C:\Program Files\Tencent\QQ\qq.exe
C:\Program Files\Tencent\QQ2\TIMPlatform.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Tencent\QQ\QQexternal.exe
C:\Program Files\Morrowsoft\MRICU\MRICU.exe
C:\Program Files\Maxthon\Max.exe
C:\WINDOWS\system32\zieninl.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\zqr\桌面\yhgidki.exe
C:\Documents and Settings\zqr\桌面\软件工具\ha_hijackthis_1991\HijackThis.exe

R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)
O2 - BHO: HelpIE Class - {5EF1DFF3-AF25-4000-A6ED-41668F83B82B} - C:\WINDOWS\system\C0MMDLG.DLL
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
O2 - BHO: Advance Helper - {8E25AC4A-B129-451B-BEE2-3B510BB751DA} - C:\WINDOWS\system32\NTDLL32.dll
O2 - BHO: IE Browser Helper - {D0903A3B-F0EA-434a-9742-98C5335C7946} - C:\WINDOWS\system32\IEHelper.dll
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [MrCard] C:\UPWIN\MRCARD.EXE
O4 - HKLM\..\Run: [ipmsg] C:\Program Files\IPMsg\ipmsg.exe
O4 - HKLM\..\Run: [rhejhki] C:\WINDOWS\system32\rhejhki.exe
O4 - HKLM\..\Run: [wk] C:\WINDOWS\system32\7a5f7bb.exe
O4 - HKLM\..\Run: [IEBarUp] RunDll32 "C:\WINDOWS\system32\IeBar1.dll",Run
O4 - HKLM\..\Run: [tfdjdeh] C:\WINDOWS\system32\tfdjdeh.exe
O4 - HKLM\..\Run: [Internet] "C:\WINDOWS\system32\internet.exe"
O4 - HKLM\..\Run: [Desktop] "C:\WINDOWS\system32\internet.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MrCard] C:\UPWIN\MRCARD.EXE
O4 - HKCU\..\Run: [MRICU2] C:\Program Files\CREC\MRICU\MRICU.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Super Rabbit IEPro] C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O4 - HKCU\..\Run: [1MJPM1G9.l] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system\MSVIDE0.dll,Run
O4 - Startup: QQ游戏启动加速程序.lnk = C:\Program Files\Tencent\QQGame\Accel.exe
O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe
O4 - Startup: 腾讯QQ珊瑚虫版.lnk = C:\Program Files\Tencent\QQ2\CoralQQ.exe
O4 - Global Startup: WanSo.lnk = ?
O4 - Global Startup: WNSO.lnk = C:\Program Files\Common Files\RGGZS\WNSO.exe
O4 - Global Startup: yhgidk.lnk = ?
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: 雅虎WIDGET - {6354ABE6-05F1-49ed-B850-E423120EC338} - http://cn.widget.yahoo.com/index.htm?source=Cns (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ2\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ2\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B4BB3DC-4EB6-4BC5-9982-E5AFE387AC24}: NameServer = 172.18.2.2
O17 - HKLM\System\CS7\Services\Tcpip\..\{3B4BB3DC-4EB6-4BC5-9982-E5AFE387AC24}: NameServer = 172.18.2.2
O17 - HKLM\System\CS8\Services\Tcpip\..\{3B4BB3DC-4EB6-4BC5-9982-E5AFE387AC24}: NameServer = 172.18.2.2
O17 - HKLM\System\CS9\Services\Tcpip\..\{3B4BB3DC-4EB6-4BC5-9982-E5AFE387AC24}: NameServer = 172.18.2.2
O20 - AppInit_DLLs: C:\WINDOWS\system32\NTDLL32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: W0RKSTATI0N (LANMANW0RKSTATI0N) - Unknown owner - C:\WINDOWS\system\WINSP00L.EXE (file missing)
O23 - Service: MICR0SOFT SVCH0ST (MS_SVCH0ST) - Unknown owner - C:\WINDOWS\system\SVCH0ST.EXE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Voolume Shadow Copyre2 (ServiceCopyre9) - Unknown owner - c:\windows\system\Microsoft\kav.exe (file missing)
O23 - Service: Windows Inventory Management Service (Servicewrapper) - Unknown owner - C:\WINDOWS\system32\ipdcl.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: winmum - Unknown owner - C:\DOCUME~1\zqr\LOCALS~1\Temp\mum1\mum1.exe (file missing)

gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT