前天按卡卡社区上所说，删除了windows\system32\winfile.dll这个病毒文件，删除时曾出现 explorer.exe 不能read的提示框，因为删除成功我也没太在意。

可今天无意间进入任务管理器后却发现explorer.exe显示占用了60MB左右的内存，然后我关掉了explorer.exe进程，发现并不像以前那样会自动再跳出来，而是一直就这样停留在桌面，于是手动启动explorer.exe后，发现该进程的内存占用率又恢复到了以前的水平20MB左右。以为问题解决，重启电脑后发现该进程的内存占用又是显示60MB而关掉它再启动后又恢复到了20MB，安全模式下杀毒也没杀出病毒……我已经不知道这是系统问题还是病毒问题了？哪位来帮下忙吧……在这先谢过了!!!!!!!!

刚用PrcView看了下explorer.exe的进程树，居然发现QQ.EXE ctfmon.exe TTraveler.exe都在它的进程树中……求楼上的看下这是什么问题？真是哭死了 T T

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <rx><C:\WINDOWS\System32\explore.exe>  [N/A]
    <zz><C:\WINDOWS\System32\intenet.exe>  [N/A]
    <wow><C:\WINDOWS\System32\Launcher.exe>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup>  [(Verified)NVIDIA Corporation]
    <McAfeeUpdaterUI><"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey>  [Network Associates, Inc.]
    <Network Associates Error Reporting Service><"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe">  [Network Associates, Inc.]
    <ShStatEXE><"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE>  [Network Associates, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{59703ED2-799E-4F3F-9EBB-41B2F1F65C07}><C:\WINDOWS\System32\winewfile.dll>  [N/A]
    <{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><e:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll>  [Anti-Malware Development a.s.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <0aMCPClient><C:\Program Files\Common Files\Stardock\MCPCore.dll>  [Stardock]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCPClient]
    <WinlogonNotify: MCPClient><C:\Program Files\Common Files\Stardock\mcpstub.dll>  [Stardock]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINDOWS\System32\LONGCH~1.SCR>  [Cyberlink Corp.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <BossIdea><; C:\WINDOWS\java\winlogin.exe>  [N/A]
    <DAEMON Tools-1033><; "C:\Program Files\D-Tools\daemon.exe" -lang 1033>  [DAEMON'S HOME]
    <HP Software Update><; C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe>  [N/A]
    <iDuba Personal FireWall><; D:\KAVTroj\KAVPFW.EXE>  [N/A]
    <ISUSPM Startup><; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup>  [InstallShield Software Corporation]
    <ISUSScheduler><; "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start>  [InstallShield Software Corporation]
    <Knight V><; "C:\Program Files\D-Tools\daemon.exe" -lang 1033>  [DAEMON'S HOME]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <Kuro_M7><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    <Load><; ?矵?
?矵??矵?
?
?耈砎??>  [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <msnmsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <nwiz><; nwiz.exe /install>  [(Verified)NVIDIA Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    <Run><; ?矵?
?矵??矵?
?
?耈砎??>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <SessIdr><; C:\WINDOWS\winlogin.exe>  [N/A]
    <Super Rabbit SRRestore><; C:\PROGRA~1\SUPERR~1\IEPRO\SRRest.exe /autosave>  [N/A]
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <TotalRecorderScheduler><; "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe">  [High Criteria inc.]

==================================
启动文件夹
[McAfee Desktop Firewall 任务栏]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\McAfee Desktop Firewall 任务栏.lnk --> C:\PROGRA~1\NETWOR~1\MCAFEE~1\FireTray.exe [Networks Associates Technology, Inc.]><N>

==================================
服务
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
  <e:\Program Files\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[McAfee Desktop Firewall Service / FireSvc]
  <"C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exe"><Networks Associates Technology, Inc.>
[HDD Temperature / HDDTService]
  <d:\Palick Soft\HDD Temperature\HDDTsvc.exe /startedbyscm:916B11C7-40E287F3-HDDTService><N/A>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework 服务 / McAfeeFramework]
  <C:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Network Associates McShield / McShield]
  <"C:\Program Files\Network Associates\VirusScan\Mcshield.exe"><Network Associates, Inc.>
[Network Associates Task Manager / McTaskManager]
  <"C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[P4P Service / P4P Service]
  <C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>

==================================

正在运行的进程
[PID: 548][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 620][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 644][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Common Files\Stardock\mcpstub.dll]  [Stardock, 0, 0, 5, 2]
[PID: 688][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\EntApi.dll]  [Network Associates, Inc, 8.0.0.277]
[PID: 700][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\EntApi.dll]  [Network Associates, Inc, 8.0.0.277]
[PID: 872][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\EntApi.dll]  [Network Associates, Inc, 8.0.0.277]
[PID: 972][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\EntApi.dll]  [Network Associates, Inc, 8.0.0.277]
[PID: 1108][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\EntApi.dll]  [Network Associates, Inc, 8.0.0.277]
[PID: 1172][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\EntApi.dll]  [Network Associates, Inc, 8.0.0.277]
[PID: 1332][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\hpzsnt08.dll]  [HP, 2,223,0,0]
[PID: 1436][C:\Program Files\Common Files\Stardock\SDMCP.exe]  [Stardock, 0, 0, 5, 8]
[PID: 1676][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Common Files\Stardock\MCPCore.dll]  [Stardock, 0, 0, 5, 2]
    [C:\WINDOWS\System32\EntApi.dll]  [Network Associates, Inc, 8.0.0.277]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\Program Files\Network Associates\VirusScan\shext.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\ShExtRes.dll]  [Network Associates, Inc., 8.0.0.912]
    [d:\Program Files\Unlocker\UnlockerCOM.dll]  [N/A, N/A]
    [e:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll]  [Anti-Malware Development a.s., 4, 0, 0, 172]
    [C:\WINDOWS\System32\xunleibho_v3.dll]  [, 4, 3, 1, 28]
[PID: 1820][C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\0804\UpdRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
[PID: 1828][C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe]  [Network Associates, Inc., 2.0.275.0]
[PID: 1836][C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\SHUTIL.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\naiwmain.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\shstat.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\Product.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\McShield.dll]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Network Associates\VirusScan\RES04\Shutilrc.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\Graphics.dll]  [Network Associates, Inc., 8.0.0.912]
[PID: 1844][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1856][C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireTray.exe]  [Networks Associates Technology, Inc., 8.0]
    [C:\WINDOWS\system32\FireCL.dll]  [Networks Associates Technology, Inc., 8.0]
    [C:\WINDOWS\system32\FireCore.dll]  [Networks Associates Technology, Inc., 2.5]
    [C:\WINDOWS\system32\FireCNL.dll]  [Networks Associates Technology, Inc., 2.5]
    [C:\WINDOWS\system32\FireCUI.dll]  [Networks Associates Technology, Inc., 2.5]
    [C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Resource\0804\CLibRL.dll]  [Networks Associates Technology, Inc., 8.0]
    [C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\nailite.dll]  [Network Associates, Inc., 1.0.452]
    [C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Resource\0804\TrayRL.dll]  [Networks Associates Technology, Inc., 8.0]
[PID: 1976][C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exe]  [Networks Associates Technology, Inc., 8.0]
    [C:\WINDOWS\system32\FireCore.dll]  [Networks Associates Technology, Inc., 2.5]
    [C:\WINDOWS\system32\FireCNL.dll]  [Networks Associates Technology, Inc., 2.5]
    [C:\WINDOWS\system32\FireCUI.dll]  [Networks Associates Technology, Inc., 2.5]
    [C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Resource\0804\NetShrRL.dll]  [Networks Associates Technology, Inc., 8.0]
[PID: 2000][C:\Program Files\Network Associates\Common Framework\FrameworkService.exe]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\applib.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\Logging.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\InternetManager.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\naInet.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\UserSpace.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\Management.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\cmalib.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\naPolicyManager.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\ScriptSubSys.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\UpdateSubSys.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\Scheduler.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\TCSubSys.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\WINDOWS\System32\EntApi.dll]  [Network Associates, Inc, 8.0.0.277]
[PID: 2044][C:\Program Files\Network Associates\VirusScan\Mcshield.exe]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Network Associates\VirusScan\Res04\McShield.DLL]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Network Associates\VirusScan\FTL.Dll]  [Network Associates, Inc., 8.0.0.135]
    [C:\Program Files\Network Associates\VirusScan\naiann.dll]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Network Associates\VirusScan\mytilus.dll]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Network Associates\Common Framework\GenEvtInf.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\VirusScan\NaEventU.DLL]  [Network Associates, Inc., 8.0.0.342]
    [C:\Program Files\Network Associates\VirusScan\Res04\naEvtRes.dll]  [Network Associates, Inc., 8.0.0.342]
    [C:\Program Files\Network Associates\VirusScan\VSIDSvr.dll]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Common Files\Network Associates\Engine\MCSCAN32.DLL]  [McAfee, Inc., 5.1.00]
    [C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\VirusScan\EntSrv.Dll]  [Network Associates, Inc, 8.0.0.277]
[PID: 180][C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\SHUTIL.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\naiwmain.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\naicondl.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\VsTskMgr.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\MIDUtil.Dll]  [McAfee, Inc., 8.0.0.152]
[PID: 240][C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe]  [Network Associates, Inc., 3.5.0.412]
    [C:\PROGRA~1\NETWOR~1\COMMON~1\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\PROGRA~1\NETWOR~1\COMMON~1\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\PROGRA~1\NETWOR~1\COMMON~1\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\PROGRA~1\NETWOR~1\COMMON~1\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\VirusScan\VsPlugin.dll]  [Network Associates, Inc., 8.0.0.912]

[C:\WINDOWS\System32\FireePO.dll]  [Networks Associates Technology, Inc., 8.0]
    [C:\WINDOWS\system32\FireCL.dll]  [Networks Associates Technology, Inc., 8.0]
    [C:\WINDOWS\system32\FireCore.dll]  [Networks Associates Technology, Inc., 2.5]
    [C:\WINDOWS\system32\FireCNL.dll]  [Networks Associates Technology, Inc., 2.5]
    [C:\WINDOWS\system32\FireCUI.dll]  [Networks Associates Technology, Inc., 2.5]
    [C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Resource\0804\CLibRL.dll]  [Networks Associates Technology, Inc., 8.0]
    [C:\WINDOWS\System32\EntApi.dll]  [Network Associates, Inc, 8.0.0.277]
[PID: 280][C:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.5672]
[PID: 460][C:\Program Files\Tencent\QQ\QQ.exe]  [TENCENT, 14, 27, 0, 082]
    [C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  [Tencent, 0, 3, 3, 6]
    [C:\WINDOWS\System32\DrvTrNTm.dll]  [High Criteria inc., 4, 3, 0, 1]
    [C:\WINDOWS\System32\DrvTrNTl.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQAPI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [C:\Program Files\Tencent\QQ\LoginCtrl.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQRes.dll]  [tencent, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQMainFrame.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\CQQApplication.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\NewSkin.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\HostingMgr.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\MailSummary.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQSpace.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQAllInOne.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\CameraDll.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\SCCore.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\msdmo.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQSysMsgMng.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\UserDefinedHead.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQCustomFace.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [C:\Program Files\Tencent\QQ\QRingMng.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\PhoneAPI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [C:\Program Files\Tencent\QQ\LongConnection.dll]  [tencent, 0, 3, 3, 8]
    [C:\Program Files\Tencent\QQ\QQAvatar.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQPet.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\BQQApplication.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQPlugin.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\CHENHU4.IME]  [chenhu, 5.4]
    [e:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll]  [Anti-Malware Development a.s., 4, 0, 0, 172]

[C:\Program Files\Tencent\QQ\CommercesMng.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [C:\Program Files\Tencent\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 4, 0, 200, 32]
    [C:\Program Files\Tencent\QQ\npkcntc.dll]  [INCA Internet Co., Ltd., 2005, 9, 1, 1]
    [C:\Program Files\Tencent\QQ\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
    [C:\Program Files\Tencent\QQ\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [C:\Program Files\Tencent\QQ\GroupConnection.dll]  [Tencent, 0, 3, 3, 5]
    [C:\Program Files\Tencent\QQ\QQSceneMng.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 0, 6, 60]
[PID: 388][C:\Program Files\Tencent\QQ\TIMPlatform.exe]  [tencent, 0, 3, 1, 8]
    [C:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[PID: 1544][C:\WINDOWS\System32\taskmgr.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\DrvTrNTm.dll]  [High Criteria inc., 4, 3, 0, 1]
    [C:\WINDOWS\System32\DrvTrNTl.dll]  [N/A, N/A]
[PID: 2172][F:\zhuangpan\PrcView_PConline\PrcView.exe]  [                    , 5.2.11.1]
[PID: 3908][C:\Program Files\Tencent\TT\TTraveler.exe]  [腾讯公司, 3.1.0.259]
    [C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  [腾讯公司, 1, 1, 0, 5]
    [C:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll]  [, 1, 0, 0, 3]
    [C:\Program Files\Tencent\TT\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 4]
    [C:\WINDOWS\System32\DrvTrNTm.dll]  [High Criteria inc., 4, 3, 0, 1]
    [C:\WINDOWS\System32\DrvTrNTl.dll]  [N/A, N/A]
    [C:\Program Files\Network Associates\VirusScan\scriptproxy.dll]  [Network Associates, Inc., 8.0.0.955]
    [C:\Program Files\Network Associates\VirusScan\mytilus.dll]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Network Associates\VirusScan\Res04\McShield.dll]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll]  [McAfee, Inc., 5.1.00]
    [C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [C:\WINDOWS\System32\SUNWB_86.IME]  [山东大学, 4.00.950]
    [C:\WINDOWS\System32\CHENHU4.IME]  [chenhu, 5.4]
[PID: 3684][F:\zhuangpan\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\WINDOWS\System32\DrvTrNTm.dll]  [High Criteria inc., 4, 3, 0, 1]
    [C:\WINDOWS\System32\DrvTrNTl.dll]  [N/A, N/A]

全贴上来了，我自己是看得一头雾水，果然是个电白……汗~~

引用:

【影子110的贴子】或者说,explorer.exe是(QQ.EXE ctfmon.exe TTraveler.exe)它们的父进程! ………………

原来如此，可是我以前也有这些进程内存却只占到20MB左右，而且关掉explorer.exe再开后，这些进程就不是在explorer.exe的进程树里了，而explorer.exe占用内存也回复到了以前20MB左右的水平。请原谅我是个电白，真的被搞糊涂了。

我把隐藏文件和系统文件全部显示后，到你说的目录下看过了没有explore.exe，上个月我好像确实中过这个木马但已经删除了，而且explorer.exe进程多占内存的现像是在这几天才出现的，上个月的时候还是20MB左右啊……

已经按你说的清理的注册表，可是开机后explorer.exe进程显示占用内存60MB的情况还是没变，一定要关掉explorer.exe进程再重开后，该进程的内存占用率才会降到20MB左右。

难道以后我每次用电脑都得要重新开关次explorer.exe