瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 求助，电脑中病毒！进程svchost.exe
swolf0309 - 2006-6-2 13:09:00
情况：
cpu资源占用一直为100％，一旦结束进程svchost.exe，则系统进入一分钟重启倒计时，用windows优化大师进程管理查看时，发现只有一个svchost.exe文件在\system32\下，一旦删除系统就崩溃了，尝试了许多杀毒软件和专杀工具都说没有毒，系统也重装过了，仍然无效，请问该怎么办啊？谢谢各位大大指教
建能 - 2006-6-2 13:05:00
svchost.exe看他的路径！在system32应该是正常的系统进程！
你下载用hijackthis1.99.1扫个log上来，方便大家分析、解决问题！1。下载HijackThis

HijackThis1.99.1可以到本版（反浏览器劫持版）置顶贴
[必读]本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931

中下载
710207 - 2006-6-2 13:15:00
svchost.exe是一个正常进程，所以一般人不要结束该进程。
除非有木马感染这个进程，或冒充这个进程。
sjdfsdfksldf - 2006-6-2 17:00:00
要先看看日志了
swolf0309 - 2006-6-2 19:16:00
以下是扫描后显示出来的，看不懂，请各位大大帮忙，谢谢！
Logfile of HijackThis v1.99.1
Scan saved at 19:14:24, on 2006-6-2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\工具\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
d:\工具\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\svchost.exe
D:\工具\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\nvsvc32.exe
D:\工具\Rising\Rav\Ravmond.exe
d:\工具\rising\rfw\RfwMain.exe
D:\工具\Dudu\DuDuAcc.exe
D:\工具\Rising\Rav\Ravmon.exe
D:\工具\Dudu\dudupros.exe
D:\工具\Rising\Rav\RavStub.exe
D:\工具\QQ\QQ.exe
D:\工具\QQ\TIMPlatform.exe
E:\我的文档\248783200522382732\HijackThis.exe

R3 - URLSearchHook: BDSrchHook Class - {2C5AA40E-8814-4EB6-876E-7EFB8B3F9662} - C:\WINDOWS\DOWNLO~1\BDSrHook.dll
O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_8888.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: DuDu.com - {6BDE1669-B490-48E3-B668-456314F2D6C3} - D:\工具\Dudu\dddiemon.dll
O2 - BHO: BDHlprObj Class - {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} - C:\WINDOWS\DOWNLO~1\BDHelper.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [BIE] Rundll32 C:\WINDOWS\DOWNLO~1\BDPlugin.dll,Rundll32
O4 - HKLM\..\Run: [chaster] C:\WINDOWS\svchost.exe
O4 - HKLM\..\Run: [supdate2.dll] RUNDLL32.EXE C:\WINDOWS\system32\supdate2.dll,Run
O4 - HKLM\..\Run: [RfwMain] "D:\工具\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "D:\工具\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: DuDu下载加速器.lnk = ?
O8 - Extra context menu item: &使用DuDu 加速器下载 - res://D:\工具\Dudu\dddmext.dll/202
O8 - Extra context menu item: &使用DuDu 加速器下载全部链接 - res://D:\工具\Dudu\dddmext.dll/203
O8 - Extra context menu item: &使用迅雷下载 - D:\工具\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\工具\Thunder\getAllurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\工具\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\工具\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\工具\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\工具\QQ\SendMMS.htm
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra 'Tools' menuitem: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A96541CC-82E9-4907-87D6-8B2DFAFDC5C0}: NameServer = 172.18.0.6
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\工具\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\工具\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\工具\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\工具\Rising\Rav\Ravmond.exe

轩辕小聪 - 2006-6-2 19:21:00
结束进程C:\WINDOWS\svchost.exe
修复：
O4 - HKLM\..\Run: [chaster] C:\WINDOWS\svchost.exe
删除C:\WINDOWS\svchost.exe

如果任务管理器结束不了这个进程，可以用瑞星防火墙的“系统状态”-“进程信息”窗口来结束。注意不要和正常的系统进程混淆了。
swolf0309 - 2006-6-2 20:39:00
大大，不好意思，刚才可能我操作有点问题，那个进程无法结束，用瑞星也看不到那个进程(windows自带的任务管理器可以看到，瑞星看到的都是system32下的svchost），我就直接在windows下把svchost.exe删了，但是病毒还是在，我又用那个工具扫描了一下，结果如下，请大大再指教，谢谢！
Logfile of HijackThis v1.99.1
Scan saved at 20:33:50, on 2006-6-2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\工具\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
d:\工具\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
D:\工具\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
d:\工具\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\工具\Rising\Rav\Ravmond.exe
D:\工具\Dudu\DuDuAcc.exe
D:\工具\Rising\Rav\Ravmon.exe
D:\工具\Dudu\dudupros.exe
D:\工具\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\wuauclt.exe
E:\我的文档\248783200522382732\HijackThis.exe

R3 - URLSearchHook: BDSrchHook Class - {2C5AA40E-8814-4EB6-876E-

7EFB8B3F9662} - C:\WINDOWS\DOWNLO~1\BDSrHook.dll
O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} -

C:\Documents and Settings\All Users\Application

Data\Microsoft\IEHelper\IEHelper_8888.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} -

C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: DuDu.com - {6BDE1669-B490-48E3-B668-456314F2D6C3} - D:\工具

\Dudu\dddiemon.dll
O2 - BHO: BDHlprObj Class - {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} -

C:\WINDOWS\DOWNLO~1\BDHelper.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} -

C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE"

/Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32

\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32

\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32

\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe

C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [BIE] Rundll32 C:\WINDOWS\DOWNLO~1

\BDPlugin.dll,Rundll32
O4 - HKLM\..\Run: [supdate2.dll] RUNDLL32.EXE C:\WINDOWS\system32

\supdate2.dll,Run
O4 - HKLM\..\Run: [RfwMain] "D:\工具\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "D:\工具\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32

\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: DuDu下载加速器.lnk = ?
O8 - Extra context menu item: &使用DuDu 加速器下载 - res://D:\工具

\Dudu\dddmext.dll/202
O8 - Extra context menu item: &使用DuDu 加速器下载全部链接 - res://D:\

工具\Dudu\dddmext.dll/203
O8 - Extra context menu item: &使用迅雷下载 - D:\工具

\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\工具

\Thunder\getAllurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\工具

\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\工具

\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\工具\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\工具

\QQ\SendMMS.htm
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!

\ASSIST~1\Assist\yasbar.dll/246
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} -

http://www.tomatolei.com (file missing)
O9 - Extra 'Tools' menuitem: 番茄花园 - {6096E38F-5AC1-4391-8EC4-

75DFA92FB32F} - http://www.tomatolei.com (file missing)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan

Object) -

http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006ne

w/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A96541CC-82E9-4907-87D6-

8B2DFAFDC5C0}: NameServer = 172.18.0.6
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA

Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising

Technology Co., Ltd. - d:\工具\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing

Rising Technology Co., Ltd. - d:\工具\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) -

Beijing Rising Technology Co., Ltd. - D:\工具\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology

Co., Ltd. - D:\工具\Rising\Rav\Ravmond.exe

轩辕小聪 - 2006-6-2 20:52:00
修复：
R3 - URLSearchHook: BDSrchHook Class - {2C5AA40E-8814-4EB6-876E-7EFB8B3F9662} - C:\WINDOWS\DOWNLO~1\BDSrHook.dll
O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_8888.dll
O2 - BHO: BDHlprObj Class - {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} - C:\WINDOWS\DOWNLO~1\BDHelper.dll
O4 - HKLM\..\Run: [supdate2.dll] RUNDLL32.EXE C:\WINDOWS\system32\supdate2.dll,Run

重启后删除：
C:\WINDOWS\DOWNLO~1\BDSrHook.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_8888.dll
C:\WINDOWS\DOWNLO~1\BDHelper.dll
C:\WINDOWS\system32\supdate2.dll
swolf0309 - 2006-6-2 21:20:00
大大，DOWNLO~1是什么文件夹啊，找不到啊
现在还是有病毒，扫描出来是
Logfile of HijackThis v1.99.1
Scan saved at 21:14:41, on 2006-6-2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\工具\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
d:\工具\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
D:\工具\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
d:\工具\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\工具\Rising\Rav\Ravmond.exe
D:\工具\Dudu\dudupros.exe
D:\工具\Rising\Rav\Ravmon.exe
D:\工具\Rising\Rav\RavStub.exe
E:\我的文档\248783200522382732\HijackThis.exe

R3 - URLSearchHook: BDSrchHook Class - {2C5AA40E-8814-4EB6-876E-7EFB8B3F9662} - C:\WINDOWS\DOWNLO~1\BDSrHook.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: DuDu.com - {6BDE1669-B490-48E3-B668-456314F2D6C3} - D:\工具\Dudu\dddiemon.dll
O2 - BHO: BDHlprObj Class - {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} - C:\WINDOWS\DOWNLO~1\BDHelper.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [BIE] Rundll32 C:\WINDOWS\DOWNLO~1\BDPlugin.dll,Rundll32
O4 - HKLM\..\Run: [RfwMain] "D:\工具\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "D:\工具\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: DuDu下载加速器.lnk = ?
O8 - Extra context menu item: &使用DuDu 加速器下载 - res://D:\工具\Dudu\dddmext.dll/202
O8 - Extra context menu item: &使用DuDu 加速器下载全部链接 - res://D:\工具\Dudu\dddmext.dll/203
O8 - Extra context menu item: &使用迅雷下载 - D:\工具\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\工具\Thunder\getAllurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\工具\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\工具\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\工具\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\工具\QQ\SendMMS.htm
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra 'Tools' menuitem: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A96541CC-82E9-4907-87D6-8B2DFAFDC5C0}: NameServer = 172.18.0.6
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\工具\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\工具\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\工具\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\工具\Rising\Rav\Ravmond.exe

请教怎么处理啊？谢谢
swolf0309 - 2006-6-3 8:02:00
请大大再指教一下，谢谢
不言放弃 - 2006-6-3 9:24:00
引用:
【swolf0309的贴子】大大，DOWNLO~1是什么文件夹啊，找不到啊
请教怎么处理啊？谢谢
...........................

就是C:\WINDOWS\Downloaded Program Files\

http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载icesword
用icesword可以找到这个文件夹及其下的文件

worldkiller - 2006-6-3 10:31:00
冰刃有这好处
1
查看完整版本: 求助，电脑中病毒！进程svchost.exe
© 2000 - 2026 Rising Corp. Ltd.