explorer.exe占用过多内存？？!!! bbs.ikaka.com

feilian - 2006-11-5 19:07:00

前天按卡卡社区上所说，删除了windows\system32\winfile.dll这个病毒文件，删除时曾出现 explorer.exe 不能read的提示框，因为删除成功我也没太在意。

可今天无意间进入任务管理器后却发现explorer.exe显示占用了60MB左右的内存，然后我关掉了explorer.exe进程，发现并不像以前那样会自动再跳出来，而是一直就这样停留在桌面，于是手动启动explorer.exe后，发现该进程的内存占用率又恢复到了以前的水平20MB左右。以为问题解决，重启电脑后发现该进程的内存占用又是显示60MB而关掉它再启动后又恢复到了20MB，安全模式下杀毒也没杀出病毒……我已经不知道这是系统问题还是病毒问题了？哪位来帮下忙吧……在这先谢过了!!!!!!!!

影子110 - 2006-11-5 19:23:00

下载SREng 并扫个日志~
http://www.kztechs.com/

feilian - 2006-11-5 19:29:00

刚用PrcView看了下explorer.exe的进程树，居然发现QQ.EXE ctfmon.exe TTraveler.exe都在它的进程树中……求楼上的看下这是什么问题？真是哭死了 T T

westbeck - 2006-11-5 19:33:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。谢谢．．．

影子110 - 2006-11-5 19:36:00

正常,上面的那些程序都是利用explorer.exe来启动的,当然也就在它的那个进程树里了~(没有了才会有点奇怪呢~)

影子110 - 2006-11-5 19:37:00

或者说,explorer.exe是(QQ.EXE ctfmon.exe TTraveler.exe)它们的父进程!

feilian - 2006-11-5 19:41:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<rx><C:\WINDOWS\System32\explore.exe> [N/A]
<zz><C:\WINDOWS\System32\intenet.exe> [N/A]
<wow><C:\WINDOWS\System32\Launcher.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup> [(Verified)NVIDIA Corporation]
<McAfeeUpdaterUI><"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey> [Network Associates, Inc.]
<Network Associates Error Reporting Service><"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"> [Network Associates, Inc.]
<ShStatEXE><"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE> [Network Associates, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{59703ED2-799E-4F3F-9EBB-41B2F1F65C07}><C:\WINDOWS\System32\winewfile.dll> [N/A]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><e:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll> [Anti-Malware Development a.s.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<0aMCPClient><C:\Program Files\Common Files\Stardock\MCPCore.dll> [Stardock]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCPClient]
<WinlogonNotify: MCPClient><C:\Program Files\Common Files\Stardock\mcpstub.dll> [Stardock]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\System32\LONGCH~1.SCR> [Cyberlink Corp.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<BossIdea><; C:\WINDOWS\java\winlogin.exe> [N/A]
<DAEMON Tools-1033><; "C:\Program Files\D-Tools\daemon.exe" -lang 1033> [DAEMON'S HOME]
<HP Software Update><; C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe> [N/A]
<iDuba Personal FireWall><; D:\KAVTroj\KAVPFW.EXE> [N/A]
<ISUSPM Startup><; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup> [InstallShield Software Corporation]
<ISUSScheduler><; "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start> [InstallShield Software Corporation]
<Knight V><; "C:\Program Files\D-Tools\daemon.exe" -lang 1033> [DAEMON'S HOME]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Kuro_M7><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
<Load><; ?矵?
?矵??矵?
?
?耈砎??> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<msnmsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<nwiz><; nwiz.exe /install> [(Verified)NVIDIA Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
<Run><; ?矵?
?矵??矵?
?
?耈砎??> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<SessIdr><; C:\WINDOWS\winlogin.exe> [N/A]
<Super Rabbit SRRestore><; C:\PROGRA~1\SUPERR~1\IEPRO\SRRest.exe /autosave> [N/A]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<TotalRecorderScheduler><; "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"> [High Criteria inc.]

==================================
启动文件夹
[McAfee Desktop Firewall 任务栏]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\McAfee Desktop Firewall 任务栏.lnk --> C:\PROGRA~1\NETWOR~1\MCAFEE~1\FireTray.exe [Networks Associates Technology, Inc.]><N>

==================================
服务
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<e:\Program Files\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[McAfee Desktop Firewall Service / FireSvc]
<"C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exe"><Networks Associates Technology, Inc.>
[HDD Temperature / HDDTService]
<d:\Palick Soft\HDD Temperature\HDDTsvc.exe /startedbyscm:916B11C7-40E287F3-HDDTService><N/A>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework 服务 / McAfeeFramework]
<C:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Network Associates McShield / McShield]
<"C:\Program Files\Network Associates\VirusScan\Mcshield.exe"><Network Associates, Inc.>
[Network Associates Task Manager / McTaskManager]
<"C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[P4P Service / P4P Service]
<C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>

==================================

猪知山 - 2006-11-5 19:42:00

进来学习下

feilian - 2006-11-5 19:44:00

正在运行的进程
[PID: 548][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 620][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 644][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\Program Files\Common Files\Stardock\mcpstub.dll] [Stardock, 0, 0, 5, 2]
[PID: 688][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\EntApi.dll] [Network Associates, Inc, 8.0.0.277]
[PID: 700][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\EntApi.dll] [Network Associates, Inc, 8.0.0.277]
[PID: 872][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\EntApi.dll] [Network Associates, Inc, 8.0.0.277]
[PID: 972][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\EntApi.dll] [Network Associates, Inc, 8.0.0.277]
[PID: 1108][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\EntApi.dll] [Network Associates, Inc, 8.0.0.277]
[PID: 1172][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\EntApi.dll] [Network Associates, Inc, 8.0.0.277]
[PID: 1332][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\hpzsnt08.dll] [HP, 2,223,0,0]
[PID: 1436][C:\Program Files\Common Files\Stardock\SDMCP.exe] [Stardock, 0, 0, 5, 8]
[PID: 1676][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\Program Files\Common Files\Stardock\MCPCore.dll] [Stardock, 0, 0, 5, 2]
[C:\WINDOWS\System32\EntApi.dll] [Network Associates, Inc, 8.0.0.277]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Network Associates\VirusScan\shext.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\ShExtRes.dll] [Network Associates, Inc., 8.0.0.912]
[d:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, N/A]
[e:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]
[C:\WINDOWS\System32\xunleibho_v3.dll] [, 4, 3, 1, 28]
[PID: 1820][C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\0804\UpdRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[PID: 1828][C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe] [Network Associates, Inc., 2.0.275.0]
[PID: 1836][C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\SHUTIL.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\naiwmain.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\shstat.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\Product.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\McShield.dll] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Network Associates\VirusScan\RES04\Shutilrc.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\Graphics.dll] [Network Associates, Inc., 8.0.0.912]
[PID: 1844][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1856][C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireTray.exe] [Networks Associates Technology, Inc., 8.0]
[C:\WINDOWS\system32\FireCL.dll] [Networks Associates Technology, Inc., 8.0]
[C:\WINDOWS\system32\FireCore.dll] [Networks Associates Technology, Inc., 2.5]
[C:\WINDOWS\system32\FireCNL.dll] [Networks Associates Technology, Inc., 2.5]
[C:\WINDOWS\system32\FireCUI.dll] [Networks Associates Technology, Inc., 2.5]
[C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Resource\0804\CLibRL.dll] [Networks Associates Technology, Inc., 8.0]
[C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\nailite.dll] [Network Associates, Inc., 1.0.452]
[C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Resource\0804\TrayRL.dll] [Networks Associates Technology, Inc., 8.0]
[PID: 1976][C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exe] [Networks Associates Technology, Inc., 8.0]
[C:\WINDOWS\system32\FireCore.dll] [Networks Associates Technology, Inc., 2.5]
[C:\WINDOWS\system32\FireCNL.dll] [Networks Associates Technology, Inc., 2.5]
[C:\WINDOWS\system32\FireCUI.dll] [Networks Associates Technology, Inc., 2.5]
[C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Resource\0804\NetShrRL.dll] [Networks Associates Technology, Inc., 8.0]
[PID: 2000][C:\Program Files\Network Associates\Common Framework\FrameworkService.exe] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\applib.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\Logging.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\InternetManager.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\naInet.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\UserSpace.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\Management.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\cmalib.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\naPolicyManager.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\ScriptSubSys.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\UpdateSubSys.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\Scheduler.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\TCSubSys.dll] [Network Associates, Inc., 3.5.0.412]
[C:\WINDOWS\System32\EntApi.dll] [Network Associates, Inc, 8.0.0.277]
[PID: 2044][C:\Program Files\Network Associates\VirusScan\Mcshield.exe] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Network Associates\VirusScan\Res04\McShield.DLL] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Network Associates\VirusScan\FTL.Dll] [Network Associates, Inc., 8.0.0.135]
[C:\Program Files\Network Associates\VirusScan\naiann.dll] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Network Associates\VirusScan\mytilus.dll] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Network Associates\Common Framework\GenEvtInf.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\VirusScan\NaEventU.DLL] [Network Associates, Inc., 8.0.0.342]
[C:\Program Files\Network Associates\VirusScan\Res04\naEvtRes.dll] [Network Associates, Inc., 8.0.0.342]
[C:\Program Files\Network Associates\VirusScan\VSIDSvr.dll] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Common Files\Network Associates\Engine\MCSCAN32.DLL] [McAfee, Inc., 5.1.00]
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\VirusScan\EntSrv.Dll] [Network Associates, Inc, 8.0.0.277]
[PID: 180][C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\SHUTIL.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\naiwmain.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\naicondl.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\VsTskMgr.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\MIDUtil.Dll] [McAfee, Inc., 8.0.0.152]
[PID: 240][C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe] [Network Associates, Inc., 3.5.0.412]
[C:\PROGRA~1\NETWOR~1\COMMON~1\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[C:\PROGRA~1\NETWOR~1\COMMON~1\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[C:\PROGRA~1\NETWOR~1\COMMON~1\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[C:\PROGRA~1\NETWOR~1\COMMON~1\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\VirusScan\VsPlugin.dll] [Network Associates, Inc., 8.0.0.912]

feilian - 2006-11-5 19:45:00

[C:\WINDOWS\System32\FireePO.dll] [Networks Associates Technology, Inc., 8.0]
[C:\WINDOWS\system32\FireCL.dll] [Networks Associates Technology, Inc., 8.0]
[C:\WINDOWS\system32\FireCore.dll] [Networks Associates Technology, Inc., 2.5]
[C:\WINDOWS\system32\FireCNL.dll] [Networks Associates Technology, Inc., 2.5]
[C:\WINDOWS\system32\FireCUI.dll] [Networks Associates Technology, Inc., 2.5]
[C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Resource\0804\CLibRL.dll] [Networks Associates Technology, Inc., 8.0]
[C:\WINDOWS\System32\EntApi.dll] [Network Associates, Inc, 8.0.0.277]
[PID: 280][C:\WINDOWS\System32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.5672]
[PID: 460][C:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 14, 27, 0, 082]
[C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\BasicCtrlDll.dll] [Tencent, 0, 3, 3, 6]
[C:\WINDOWS\System32\DrvTrNTm.dll] [High Criteria inc., 4, 3, 0, 1]
[C:\WINDOWS\System32\DrvTrNTl.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[C:\Program Files\Tencent\QQ\LoginCtrl.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\QQMainFrame.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\CQQApplication.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\QQAllInOne.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\SCCore.dll] [N/A, N/A]
[C:\WINDOWS\System32\msdmo.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\QQSysMsgMng.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\QQCustomFace.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\Program Files\Tencent\QQ\QRingMng.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[C:\Program Files\Tencent\QQ\LongConnection.dll] [tencent, 0, 3, 3, 8]
[C:\Program Files\Tencent\QQ\QQAvatar.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\QQPet.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\BQQApplication.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\QQPlugin.dll] [N/A, N/A]
[C:\WINDOWS\System32\CHENHU4.IME] [chenhu, 5.4]
[e:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]

feilian - 2006-11-5 19:45:00

[C:\Program Files\Tencent\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[C:\Program Files\Tencent\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 4, 0, 200, 32]
[C:\Program Files\Tencent\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2005, 9, 1, 1]
[C:\Program Files\Tencent\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[C:\Program Files\Tencent\QQ\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[C:\Program Files\Tencent\QQ\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[C:\Program Files\Tencent\QQ\QQSceneMng.dll] [N/A, N/A]
[C:\Program Files\Tencent\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 0, 6, 60]
[PID: 388][C:\Program Files\Tencent\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[C:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 1544][C:\WINDOWS\System32\taskmgr.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\DrvTrNTm.dll] [High Criteria inc., 4, 3, 0, 1]
[C:\WINDOWS\System32\DrvTrNTl.dll] [N/A, N/A]
[PID: 2172][F:\zhuangpan\PrcView_PConline\PrcView.exe] [ , 5.2.11.1]
[PID: 3908][C:\Program Files\Tencent\TT\TTraveler.exe] [腾讯公司, 3.1.0.259]
[C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] [腾讯公司, 1, 1, 0, 5]
[C:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] [, 1, 0, 0, 3]
[C:\Program Files\Tencent\TT\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 4]
[C:\WINDOWS\System32\DrvTrNTm.dll] [High Criteria inc., 4, 3, 0, 1]
[C:\WINDOWS\System32\DrvTrNTl.dll] [N/A, N/A]
[C:\Program Files\Network Associates\VirusScan\scriptproxy.dll] [Network Associates, Inc., 8.0.0.955]
[C:\Program Files\Network Associates\VirusScan\mytilus.dll] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Network Associates\VirusScan\Res04\McShield.dll] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll] [McAfee, Inc., 5.1.00]
[C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\WINDOWS\System32\SUNWB_86.IME] [山东大学, 4.00.950]
[C:\WINDOWS\System32\CHENHU4.IME] [chenhu, 5.4]
[PID: 3684][F:\zhuangpan\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\System32\DrvTrNTm.dll] [High Criteria inc., 4, 3, 0, 1]
[C:\WINDOWS\System32\DrvTrNTl.dll] [N/A, N/A]

feilian - 2006-11-5 19:46:00

全贴上来了，我自己是看得一头雾水，果然是个电白……汗~~

feilian - 2006-11-5 19:48:00

引用:

【影子110的贴子】或者说,explorer.exe是(QQ.EXE ctfmon.exe TTraveler.exe)它们的父进程!
………………

原来如此，可是我以前也有这些进程内存却只占到20MB左右，而且关掉explorer.exe再开后，这些进程就不是在explorer.exe的进程树里了，而explorer.exe占用内存也回复到了以前20MB左右的水平。请原谅我是个电白，真的被搞糊涂了。

影子110 - 2006-11-5 19:58:00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<rx><C:\WINDOWS\System32\explore.exe> [N/A]
<zz><C:\WINDOWS\System32\intenet.exe> [N/A]
<wow><C:\WINDOWS\System32\Launcher.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{59703ED2-799E-4F3F-9EBB-41B2F1F65C07}><C:\WINDOWS\System32\winewfile.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<BossIdea><; C:\WINDOWS\java\winlogin.exe> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
<Load><; ?矵?
?矵??矵?
?
?耈砎??> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
<Run><; ?矵?
?矵??矵?
?
?耈砎??> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<SessIdr><; C:\WINDOWS\winlogin.exe> [N/A]
进入安全模式,清理(删除)上面的启动项~

查找并删除
C:\WINDOWS\System32\explore.exe
C:\WINDOWS\System32\intenet.exe
C:\WINDOWS\System32\Launcher.exe
C:\WINDOWS\System32\winewfile.dll
C:\WINDOWS\java\winlogin.exe
C:\WINDOWS\winlogin.exe

有的文件可能是隐藏文件(所以需要设置显示所有文件后再删~)
打开我的电脑》工具》文件夹选项》查看》显示所有文件，不隐藏受保护的操作系统文件》确定

或者直接下载IceSword来删除!
使用IceSword杀毒的一些基本操作
http://forum.ikaka.com/topic.asp?board=28&artid=7168178
下载就到泡泡版主这里下吧~
http://free5.ys168.com/?aqfrs

另,注册表中被修改的可能已经无法轻易恢复了~如果可能,建议楼主如果有做系统备份,就还原一下系统盘.或重装系统.

影子110 - 2006-11-5 19:59:00

但是,你电脑里的explore.exe(可能已经不是原来的了,原来的路径是C:\WINDOWS\explore.exe)
C:\WINDOWS\System32\explore.exe(可能已经被它取代了,这是个木马~)

所以,你的怀疑还是对的~~!