用BT的时候CUP占用突然增大，求救是什么回事 bbs.ikaka.com

a455685 - 2006-7-13 23:02:00

以前是不会的，现在一用BT或者用迅雷下载普通的文件，在任务管理器里面看到“SYSTEM”的CUP占用会突然增加到99%，剩余就剩下一点点了。
请问是什么回事呢？

请教各位大侠

不言放弃 - 2006-7-13 23:03:00

【回复“a455685”的帖子】
先进入安全模式下断网查杀一下

a455685 - 2006-7-13 23:04:00

贴上System Repair Engineer的日志

2006-07-13,23:00:13

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [Microsoft Corporation]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
<DesktopSprite><C:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe> [SnowFox Studio.]
<H/PC Connection Agent><"C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation]
<SKYNET Personal FireWall><C:\Program Files\SkyNet\FireWall\PFWmain.exe> [sky.net.cn]
<NvCplDaemon><RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<FmctrlTray><Fmctrl.EXE> [ForteMedia, Inc.]
<DAEMON Tools-2052><"C:\Program Files\D-Tools\daemon.exe" -lang 1033> [DAEMON'S HOME]
<SunJavaUpdateSched><C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe> [Sun Microsystems, Inc.]
<KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize> [Kaspersky Lab]
<Windows木马防火墙><C:\Program Files\ftc\Trojanwall.exe> [风云谷]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> []

==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users.WINNT\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>
[Microsoft Office]
<C:\Documents and Settings\All Users.WINNT\「开始」菜单\程序\启动\Microsoft Office.lnk><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[InstallDriver Table Manager / IDriverT]
<"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPod Service / iPodService]
<"C:\Program Files\iPod\bin\iPodService.exe"><N/A>
[kavsvc / kavsvc]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab>
[liangzi / liangzi]
<C:\WINNT\G_Server2.0.exe><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[winaua / winaua]
<C:\DOCUME~1\GR\LOCALS~1\Temp\aua\aua.exe -R><N/A>
[winmum / winmum]
<C:\DOCUME~1\GR\LOCALS~1\Temp\mum\mum.exe -R><N/A>

a455685 - 2006-7-13 23:04:00

贴上System Repair Engineer的日志

2006-07-13,23:00:13

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [Microsoft Corporation]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
<DesktopSprite><C:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe> [SnowFox Studio.]
<H/PC Connection Agent><"C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation]
<SKYNET Personal FireWall><C:\Program Files\SkyNet\FireWall\PFWmain.exe> [sky.net.cn]
<NvCplDaemon><RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<FmctrlTray><Fmctrl.EXE> [ForteMedia, Inc.]
<DAEMON Tools-2052><"C:\Program Files\D-Tools\daemon.exe" -lang 1033> [DAEMON'S HOME]
<SunJavaUpdateSched><C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe> [Sun Microsystems, Inc.]
<KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize> [Kaspersky Lab]
<Windows木马防火墙><C:\Program Files\ftc\Trojanwall.exe> [风云谷]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> []

==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users.WINNT\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>
[Microsoft Office]
<C:\Documents and Settings\All Users.WINNT\「开始」菜单\程序\启动\Microsoft Office.lnk><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[InstallDriver Table Manager / IDriverT]
<"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPod Service / iPodService]
<"C:\Program Files\iPod\bin\iPodService.exe"><N/A>
[kavsvc / kavsvc]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab>
[liangzi / liangzi]
<C:\WINNT\G_Server2.0.exe><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[winaua / winaua]
<C:\DOCUME~1\GR\LOCALS~1\Temp\aua\aua.exe -R><N/A>
[winmum / winmum]
<C:\DOCUME~1\GR\LOCALS~1\Temp\mum\mum.exe -R><N/A>

a455685 - 2006-7-13 23:05:00

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINNT\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll, Sun Microsystems, Inc.>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll, Thunder Networking Technologies,LTD>
[Java Plug-in]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll, Sun Microsystems, Inc.>
[Create Mobile Favorite]
{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} <C:\PROGRA~1\MICROS~4\inetrepl.dll, Microsoft Corporation>
[Create Mobile Favorite]
{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} <C:\PROGRA~1\MICROS~4\inetrepl.dll, Microsoft Corporation>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\qq\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[CEditCtrl Object]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINNT\system32\aliedit\AliEdit.dll, www.alipay.com>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\system32\wuweb.dll, Microsoft Corporation>
[Java Plug-in]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll, Sun Microsystems, Inc.>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINNT\DOWNLO~1\SUBMIT~1.DLL, >
[Java Plug-in]
{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_07]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll, Sun Microsystems, Inc.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[Google 搜索(&G)]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[使用影音传送带下载全部链接]
<C:\Program Files\Xi\NetTransport 2\NTAddList.html, N/A>
[反向链接]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\qq\SendMMS.htm, N/A>
[类似网页]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html, N/A>
[缓存的网页快照]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html, N/A>
[翻译英文字词(&T)]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html, N/A>

a455685 - 2006-7-13 23:05:00

==================================
正在运行的进程
[PID: 192][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 212][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 232][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6997>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 260][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.7035>
[C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 272][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.7011>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 432][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 472][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.7059>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 504][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 552][C:\WINNT\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.01.4201>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 576][C:\WINNT\system32\regsvc.exe] <Microsoft Corporation><5.00.2195.6701>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 592][C:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6972>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 696][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 712][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 724][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 1024][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[C:\WINNT\system32\nvtuicpl.cpl] <NVIDIA Corporation><6.14.01.4201>
[C:\WINNT\system32\NVWRSZHC.DLL] <NVIDIA Corporation><6.14.01.4201>
[C:\WINNT\system32\vp6dec_settings.cpl] <N/A><N/A>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[C:\WINNT\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><6.0.1.2003110300>
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1>
[PID: 1132][C:\Program Files\SkyNet\FireWall\PFWmain.exe] <sky.net.cn><2.5.0.120>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 1152][C:\WINNT\system32\Fmctrl.EXE] <ForteMedia, Inc.><1.00>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 1164][C:\Program Files\D-Tools\daemon.exe] <DAEMON'S HOME><3.46.0.0>
[C:\WINNT\daemon.dll] <N/A><3.46.0.0>
[C:\Program Files\D-Tools\PFCTOC.DLL] <Padus(R), Inc.><1, 0, 0, 12>
[C:\Program Files\D-Tools\Plugins\Images\bw5mount.dll] <N/A><1.0.2.0>
[C:\Program Files\D-Tools\Plugins\Images\ccdmount.dll] <GENERIC><1.02.0.0>
[C:\Program Files\D-Tools\Plugins\Images\mdsmount.dll] <GENERIC><1.01.0.0>
[C:\Program Files\D-Tools\Plugins\Images\nrgmount.dll] <GENERIC><1.02.0.0>
[C:\Program Files\D-Tools\Plugins\Images\pdimount.dll] <GENERIC><1.01.0.0>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 1104][C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe] <Sun Microsystems, Inc.><5.0.70.3>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 1156][C:\Program Files\ftc\Trojanwall.exe] <风云谷><5.2.0.1758>
[C:\Program Files\ftc\ftcapi.dll] <fygsoft><1.0.0.0>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 1184][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 1196][C:\Program Files\MSN Messenger\MsnMsgr.Exe] <Microsoft Corporation><7.0.0816>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[C:\WINNT\system32\msdmo.dll] <N/A><N/A>
[PID: 1204][C:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe] <SnowFox Studio.><2.0.7.25>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 1212][C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE] <Microsoft Corporation><3.5.0.1240>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 1560][C:\WINNT\system32\conime.exe] <Microsoft Corporation><5.00.2195.6655>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[PID: 864][C:\Program Files\Maxthon\Maxthon.exe] <MY Soft Technology><1, 1, 1, 20>
[C:\Program Files\Maxthon\maxzlib.dll] < ><1, 0, 0, 2>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>
[C:\Program Files\Maxthon\Services\RealTime\real_time.dll] <><1, 0, 0, 1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll] <Kaspersky Lab><1.0.227.342>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\concl.dll] <Kaspersky Lab><1.0.227.3>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.227.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ipc.dll] <Kaspersky Lab><5.0.227.0>
[C:\WINNT\system32\macromed\flash\Flash.ocx] <Macromedia, Inc.><7,0,14,0>
[PID: 1644][C:\Documents and Settings\GR\桌面\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\ftc\ProcessHook.dll] <Fygsoft and Microsoft><1.1.0.50>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS Error. [超级解霸3000]
.JS Error. [C:\WINNT\system32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

现在进行时 - 2006-7-13 23:07:00

<C:\WINNT\G_Server2.0.exe><N/A>

[winaua / winaua]
<C:\DOCUME~1\GR\LOCALS~1\Temp\aua\aua.exe -R><N/A>
[winmum / winmum]
<C:\DOCUME~1\GR\LOCALS~1\Temp\mum\mum.exe -R><N/A>

a455685 - 2006-7-13 23:07:00

谢谢2楼的意见。
已经按装了“卡巴斯基”和“木马清道夫”在安全模式下全面扫描了。没什么发现。
另外，在断开BT后就会恢复正常。

a455685 - 2006-7-13 23:09:00

回6楼，用hijackthis查的时候，已经将上面3个删除了。
同时也在WINDOWS-管理-服务，里面将这几个禁用了。

不言放弃 - 2006-7-13 23:18:00

【回复“a455685”的帖子】
[liangzi / liangzi]
<C:\WINNT\G_Server2.0.exe><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[winaua / winaua]
<C:\DOCUME~1\GR\LOCALS~1\Temp\aua\aua.exe -R><N/A>
[winmum / winmum]

开始－－控制面板－－性能和维护－－管理工具－－服务
禁用如下服务：
[liangzi / liangzi]
[winaua / winaua]
[winmum / winmum]

开始－－运行
输入regedit
确定
进入注册表
依次展开
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Services](X代表1,2,3,4....)
找到后删除如下文件夹：
liangzi文件夹
winaua文件夹
winmum文件夹

删除
C:\WINNT\G_Server2.0.exe
以及C:\DOCUME~1\GR\LOCALS~1\Temp\下的所有文件及文件夹

若能找到如下文件
同样删除之
C:\WINNT\G_Server2.0.dll
C:\WINNT\G_Server2.0key.dll
C:\WINNT\G_Server2.0_hook.dll

a455685 - 2006-7-13 23:59:00

谢谢，正在尝试

瑞星卡卡安全论坛