前天一早开机，发现cpu呼呼的转，鼠标动不了，想关机也关不了，就停在了“保存设置”。硬关机重启，用新安装的瑞星2007后全盘杀毒，发现Trojan.DL.Agent.cjy和Trojan.QHost.ey类型及其变种等3个病毒，病毒地址为：C:\Program Files\ChinaNet\SysPlug\js-39077.6146869444\SingleUpdate\lighten.cab>>ltnward.exe>>pecompact2x和C:\System Volume Information\_restore{EB2E509D-8BEC-40BD-928C-E6130C524851}\RP238\A0086893.dll，其中exe文件以暴风影音图标显示。将其清除后，重新启动电脑，一会儿后发现进程中的SVCHOST进程又占用了99%了，占用内存70M左右。随后接着在windows安全模式和dos两种界面下又都全盘杀毒一次，未发现病毒。重新启动进入系统，一会儿SVCHOST又占用cpu99%。已经反复折腾了两天，真是心力憔悴，焦头烂额了。因为是工作电脑，公司规定不得随意格式化，这两天耽误了不少工作，真是屋漏偏逢连夜雨。（注明: XP Home版系统，1.6GHz，通过电信的星空极速拨号上网。）这里将扫描日志登陆，请大家多多指教，万分感谢！

Logfile of Kaka v2. 0. 3. 0 Scan Module v1. 0. 6. 1
Scan saved at 23:36:47, on 2007-04-14
Platform: Microsoft Windows XP Personal Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))


R3 - Default URLSearchHook is missing
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program

Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar:  (file missing)
O3 - Toolbar:  (file missing)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} -

C:\WINDOWS\system32\kakatool.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef

/Migration32
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - Startup: desktop.ini =
O4 - Global Startup: desktop.ini =
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live

Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder

Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program

Files\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/windows/ie_intl/cn/start/
O16 - DPF: DirectAnimation Java Classes - file://C:\WINDOWS\system32\dajava.cab
O16 - DPF: Internet Explorer Classes for Java - file://C:\WINDOWS\system32\iejava.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{33F2B599-63CB-4C4C-91B3-E0EAC29BFB2A}: NameServer =

218.2.135.1,61.147.37.1
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32

\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: ic32pp - ?{BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - (no file)
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1

\MSGRAP~1.DLL
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32

\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32

\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1

\MSGRAP~1.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1

\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32

\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32

\wiascr.dll
O23 - Service: Application Management (AppMgmt) -  - C:\WINDOWS\system32\svchost.exe -k

netsvcs
O23 - Service: FspadSvc (FspadSvc) -  - C:\Program Files\AVC Finger-sensing Pad

Driver\FspadSvr.exe
O23 - Service: General Updater/AutoUpdater Service (GUA) - lenovo - "C:\Program

Files\lenovo\GUA\GUA.exe"
O23 - Service: IGRS (IGRS) - Lenovo Group Limited - C:\Program Files\lenovo\IGRS\IGRS.exe
O23 - Service: IGRSFILE (IGRSFILE) - Lenovo Group Limited - C:\Program Files\lenovo\IGRS

Profiles\File Profile\IgrsFile.exe
O23 - Service: IgrsMonitor (IgrsMonitor) - Lenovo Group Limited - "C:\Program

Files\lenovo\IGRS\Ext\IgrsMonitor.exe"
O23 - Service: InterBase Guardian (InterBaseGuardian) - InterBase Software Corp. -

C:\Program Files\InterBase Corp\InterBase\bin\ibguard.exe -s
O23 - Service: InterBase Server (InterBaseServer) - InterBase Software Corp. - C:\Program

Files\InterBase Corp\InterBase\bin\ibserver.exe -s -g
O23 - Service: MicroGrid DirectRouter (MicroGrid.DirectRouter) - Lenovo Group Limited -

C:\Program Files\lenovo\IGRS\Ext\router.exe
O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation - C:\WINDOWS\system32

\pgpsdkserv.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. -

c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology

Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology

Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe"
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. -

"C:\Program Files\Rising\Rav\Ravmond.exe"
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - "C:\Program Files\Common

Files\Symantec Shared\Security Center\SymWSC.exe"
O23 - Service: winaua (winaua) -  - C:\DOCUME~1\robin\LOCALS~1\Temp\aua1\aua1.exe -R
O23 - Service: winmum (winmum) -  - C:\DOCUME~1\robin\LOCALS~1\Temp\mum1\mum1.exe -R
O23 - Service: WMCSVC (WMCSVC) - Lenovo Group Limited - C:\Program

Files\lenovo\IGRS\Ext\wmcsvc.exe

这日志不能完全看清。

去反毒区扫SRENG日志，发到那里去。

这没人看的。

SVCHOST进程占用cpu99%,有很多情况,要是同时出现4,5个这样的进程那是正常的,多了就可能是病毒,SVCHOST进程关连着很多服务,你试试关掉自动更新,我也出现过和LZ一样的情况,关掉自动更新就正常了

你的的进程扫描报告太复杂了!!呵呵,没有法子看完!最起码有个线索!!::
O23 - Service: winaua (winaua) - - C:\DOCUME~1\robin\LOCALS~1\Temp\aua1\aua1.exe -R
O23 - Service: winmum (winmum) - - C:\DOCUME~1\robin\LOCALS~1\Temp\mum1\mum1.exe -R