瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 帮忙看下日志,我电脑CPU使用100%怎么回事

1   1  /  1  页   跳转

帮忙看下日志,我电脑CPU使用100%怎么回事

帮忙看下日志,我电脑CPU使用100%怎么回事

帮忙看下日志,我电脑CPU使用100%怎么回事,而且右角老是自动升起窗口,高手帮忙解决下,谢谢了!

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      16:25:58, 日期 2006-3-31
操作系统:  Windows XP SP2 (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程:         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
E:\Rising\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
E:\Rising\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwproxy.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Rising\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\Rising\Rising\Rav\Rav.exe
C:\Documents and Settings\zxhpal.DSFDSFDS-73AB03\桌面\HijackThis1991zww.exe

R3 - 默认的URLSearchHook丢失。用HijackThis修复
O2 - BHO: (no name) - {16A770A0-0E87-4278-B748-2460D64A8386}? - (no file)
O2 - BHO: MEobjectSDT - {4136C3F6-7636-49bf-A122-D4DA53B1ADDF}? - (no file)
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\chinanet\VNETTR~1.DLL
O2 - BHO: (no name) - {4E83D567-4697-4F7B-B1F0-A513B01DB89A}? - (no file)
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B}? - (no file)
O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A}? - (no file)
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A}? - D:\浩方\浩方对战平台\GameClient.exe
O16 - DPF: _{2EA6D939-4445-43F1-A12B-8CB3DDA8B855} - http://www.bluesky.cn/download/v2_60.cab
O16 - DPF: _{7A818607-0D4D-4C09-AB73-E4FC105FD9C3} - http://radio.cga.com.cn/mdc800.cab
O16 - DPF: _{991481A7-4669-4E15-8C24-100404E1F5CB} - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {32D72994-45B9-42B5-8980-FB561D1BE2D0} (nEdit Control) - https://ekey.163.com/nEdit.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AXSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB9868F8-A062-4E1F-B177-ED01CD8BBE22}: NameServer = 202.101.224.69,202.101.226.69
O17 - HKLM\System\CCS\Services\Tcpip\..\{F518B497-888A-4A71-AB17-DCB8FC45174E}: NameServer = 202.101.224.69 202.101.226.68
O23 - NT 服务: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - NT 服务: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rising\Rav\Ravmond.exe
O23 - NT 服务: SDAgent Service (SDAgentService) - Unknown owner - C:\Program Files\Common Files\smartde\sde.exe (file missing)

最后编辑2006-03-31 18:01:20
分享到:
gototop
 

注册表查到那个了,但不能删除
刚才的扫描里C盘有个文件RECYCLER,我扫描修复了,但重起以后,C盘又有了这个文件,而且是被磁盘保护
O23 - NT 服务: SDAgent Service (SDAgentService) - Unknown owner - C:\Program Files\Common Files\smartde\sde.exe (file missing)中的sde.exe是什么,我以前怎么没看到这个东东
任务管理器里占内存多的是explorer.exe  IEXPLORE.EXE  svchost.exe  rfwproxy.exe这4个都是占用2万多K的,其他都是16K-几千K的,进程一起有27个。我不会看IceSword.exe里的模块意思,有的都有100多个模块信息,看不明白,不言放弃,帮忙解决下吧,谢谢!同时也是我学习的好机会

下面是我刚扫描的日志:
HijackThis_zww汉化版扫描日志 V1.99.1
保存于      16:56:27, 日期 2006-3-31
操作系统:  Windows XP SP2 (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程:         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
E:\Rising\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
E:\Rising\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwproxy.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Rising\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\Program Files\ChinaNet\VnetClient.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\zxhpal.DSFDSFDS-73AB03\桌面\HijackThis1991zww.exe

O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\chinanet\VNETTR~1.DLL
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A}? - D:\浩方\浩方对战平台\GameClient.exe
O16 - DPF: _{2EA6D939-4445-43F1-A12B-8CB3DDA8B855} - http://www.bluesky.cn/download/v2_60.cab
O16 - DPF: _{7A818607-0D4D-4C09-AB73-E4FC105FD9C3} - http://radio.cga.com.cn/mdc800.cab
O16 - DPF: _{991481A7-4669-4E15-8C24-100404E1F5CB} - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {32D72994-45B9-42B5-8980-FB561D1BE2D0} (nEdit Control) - https://ekey.163.com/nEdit.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AXSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB9868F8-A062-4E1F-B177-ED01CD8BBE22}: NameServer = 202.101.224.69,202.101.226.69
O17 - HKLM\System\CCS\Services\Tcpip\..\{F518B497-888A-4A71-AB17-DCB8FC45174E}: NameServer = 202.101.224.69 202.101.226.68
O23 - NT 服务: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - NT 服务: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rising\Rav\Ravmond.exe
O23 - NT 服务: SDAgent Service (SDAgentService) - Unknown owner - C:\Program Files\Common Files\smartde\sde.exe (file missing)

gototop
 

sde.exe原来是个流氓软件啊,服务项我已经禁用了,但注册表里还是删除不了,请帮助

CPU里占用多的就个System Idle Process 占用95,svchost.exe占用2,有好几个同名的,只有其中一个占用,VnetClient.exe占用2,IEXPLORE.EXE占用3,CPU使用跳来跳去的,有时候3%,有时候100%,不知道怎么回事
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\chinanet\VNETTR~1.DLL这个我修复不了。。。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT