就是打开一个网页的时候,占用cpu很多,有时达90%多
hijackthis.log如下
Logfile of HijackThis v1.99.1
Scan saved at 9:57:16, on 2006-4-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
H:\program files\杀毒相关\HijackThis\HijackThis.exe
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v5.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getAllurl.htm
O8 - Extra context menu item: 导入当前页到超星阅览器(&A) - C:\Program Files\SSREADER36\ss_all.htm
O8 - Extra context menu item: 导入选中部分到超星阅览器(&S) - C:\Program Files\SSREADER36\ss_select.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{DBC8C5C2-BF88-42B9-B522-B4D3D6FF61AE}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: KB2357801.LOG
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: MySQL - Unknown owner - C:\MySQL\MySQL.exe (file missing)
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - C:\Tomcat 5.5\bin\tomcat5.exe" //RS//Tomcat5 (file missing)
Ati2evxx.exe是显卡驱动程序。
---------------------------
procexp的log如下
Process PID CPU 描述 公司名
系统空闲进程 0 16.92
Interrupts n/a 硬件中断
DPCs n/a 延缓程序调用
System 4
smss.exe 612 Windows NT Session Manager Microsoft Corporation
csrss.exe 684 Client Server Runtime Process Microsoft Corporation
winlogon.exe 708 Windows NT Logon Application Microsoft Corporation
services.exe 760 1.54 Services and Controller app Microsoft Corporation
ati2evxx.exe 940
svchost.exe 960 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1036 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1120 Generic Host Process for Win32 Services Microsoft Corporation
wscntfy.exe 648 Windows Security Center Notification App Microsoft Corporation
svchost.exe 1172 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1248 Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 1740 Spooler SubSystem App Microsoft Corporation
mysqld-nt.exe 1992
lsass.exe 772 LSA Shell (Export Version) Microsoft Corporation
ati2evxx.exe 1504
explorer.exe 1600 1.54 Windows Explorer Microsoft Corporation
IEXPLORE.EXE 600 63.08 Internet Explorer Microsoft Corporation
upengine.exe 1180 紫光拼音输入法引擎 北京清华紫光软件股份有限公司
procexp.exe 840 16.92 Sysinternals Process Explorer 汉化: 余飞雨
还有开机的时候弹出的提示框如下图
就是DLL C:\WINDOWS\system32\lsass32.dll为无效的Windows映像。