求教各位大虾，本人机器里面有个mshcp.exe的进程老是占用80%以上的CPU，我的杀毒软件也查不出有病毒迹象，而且这个mshcp.exe进程无法强制关闭，请问是病毒吗？该怎么处理呢？ 谢谢啦~

引用:

【 火影忍者的贴子】 下载 System Repair Engineer， http://www.kztechs.com/sreng/download.html 1 解压缩sreng2.zip 2 运行SREng.exe 3 智能扫描=》扫描=》保存报告 4 把日志中的报告完整拷贝贴上来，不要修改 日志一次发不完，请分次发上来 ………………

大虾，
  报告太长不修改的话上传不上来啊~

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <IgfxTray><C:\WINNT\System32\igfxtray.exe>  [Intel Corporation]
    <HotKeysCmds><C:\WINNT\System32\hkcmd.exe>  [Intel Corporation]
    <ClocX><D:\ClocX.exe>  [N/A]
    <AeXAgentLogon><"C:\Program Files\Altiris\eXpress\NS Client\AeXAgentActivate.exe" /logon>  [Altiris, Inc.]
    <OfficeScanNT 监控程序><"C:\OfficeScan NT\pccntmon.exe" -HideWindow>  [Trend Micro Inc.]
    <HPLJ Config><C:\Program Files\Hewlett-Packard\LaserJet 33xx\hppcfg.exe /installparams>  [N/A]
    <AClntUsr><C:\Program Files\Altiris\AClient\AClntUsr.EXE>  []
    <Client Access Service><"C:\Program Files\IBM\Client Access\cwbsvstr.exe">  [IBM Corporation]
    <Client Access Help Update><"C:\Program Files\IBM\Client Access\cwbinhlp.exe">  [IBM Corporation]
    <Client Access Check Version><"C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN>  [N/A]
    <Client Access Express Welcome><"C:\Program Files\IBM\Client Access\cwbwlwiz.exe">  [IBM Corporation]
    <Client Access PC5250 Sound><"C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe">  [IBM]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><AMInit.dll>  [Altiris Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    <Windows Media Player><C:\WINNT\System32\setup\wmpocm.exe /ShowWMP>  [(Verified)Microsoft Windows 2000 Publisher]

==================================
启动文件夹
[Microsoft Office]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>

==================================
服务
[Altiris Client Service / AClient][Running/Auto Start]
  <C:\Program Files\Altiris\AClient\AClient.exe -service><Altiris, Inc.>
[Altiris Agent / AeXNSClient][Running/Auto Start]
  <C:\Program Files\Altiris\eXpress\NS Client\AeXNSAgent.exe><Altiris, Inc.>
[iSeries Access for Windows Remote Command / Cwbrxd][Stopped/Manual Start]
  <C:\WINNT\CWBRXD.EXE><IBM Corporation>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[DameWare Mini Remote Control / DWMRCS][Running/Auto Start]
  <C:\WINNT\SYSTEM32\DWRCS.EXE -service><DameWare Development LLC>
[Machine Debug Manager / MDM][Running/Auto Start]
  <"C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"><Microsoft Corporation>
[Microsoft DHCPA Service / Microsoft DHCPA Service][Running/Auto Start]
  <"C:\WINNT\system32\dllcache\mshcp.exe"><N/A>
[OfficeScanNT 实时扫描 / ntrtscan][Running/Auto Start]
  <"C:\OfficeScan NT\ntrtscan.exe"><Trend Micro Inc.>
[OfficeScanNT Personal Firewall / OfcPfwSvc][Running/Auto Start]
  <"C:\OfficeScan NT\OfcPfwSvc.exe"><Trend Micro Inc.>
[OfficeScanNT 监听程序 / tmlisten][Running/Auto Start]
  <"C:\OfficeScan NT\tmlisten.exe"><Trend Micro Inc.>

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Altiris Kernel Driver / AlKernel][Running/Manual Start]
  <System32\Drivers\AlKernel.sys><N/A>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[Intel(R) PRO/1000 Adapter Driver / E1000][Running/Manual Start]
  <System32\DRIVERS\e1000nt5.sys><Intel Corporation>
[ialm / ialm][Running/Manual Start]
  <System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[OMCI / OMCI][Running/System Start]
  <\SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS><Dell Computer Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[smwdm / smwdm][Running/Manual Start]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[Trend Micro Filter / TmFilter][Running/Auto Start]
  <\??\C:\OfficeScan NT\TmFilter.sys><Trend Micro Inc.>
[Common Firewall Driver / TM_CFW][Running/Auto Start]
  <\??\C:\OfficeScan NT\tm_cfw.sys><Trend Micro Inc.>
[Trend Micro VSAPI NT / VSApiNt][Running/Auto Start]
  <\??\C:\OfficeScan NT\VSApiNt.sys><Trend Micro Inc.>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/System Start]
  <system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
  <system32\drivers\ialmkchw.sys><Intel Corporation>

==================================
浏览器加载项
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\FLASH.OCX, Macromedia, Inc.>
[导出到 Microsoft Excel(&x)]
  <res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>

==================================
正在运行的进程
[PID: 140][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.5382]
[PID: 164][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.5265]
[PID: 160][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6898]
    [C:\WINNT\system32\AMInit.dll]  [Altiris Inc., 6, 0, 1024]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.3649]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
[PID: 1408][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3502.5321]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.5308]
    [C:\WINNT\system32\AMInit.dll]  [Altiris Inc., 6, 0, 1024]
    [C:\WINNT\System32\msimtf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\WINNT\System32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.3649]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.1.2003110300]
    [C:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\Program Files\Microsoft Office\Office10\msohev.dll]  [Microsoft Corporation, 10.0.2609]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
[PID: 1856][C:\WINNT\SYSTEM32\DWRCST.exe]  [DameWare Development, 4, 5, 0, 1]
    [C:\WINNT\SYSTEM32\AMInit.dll]  [Altiris Inc., 6, 0, 1024]
    [C:\WINNT\SYSTEM32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.3649]
    [C:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\WINNT\SYSTEM32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
[PID: 1796][C:\WINNT\System32\hkcmd.exe]  [Intel Corporation, 3,0,0,1715]
    [C:\WINNT\System32\hccutils.DLL]  [Intel Corporation, 3,0,0,1715]
    [C:\WINNT\System32\AMInit.dll]  [Altiris Inc., 6, 0, 1024]
    [C:\WINNT\System32\igfxdev.dll]  [Intel Corporation, 3,0,0,1715]
    [C:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\WINNT\System32\igfxsrvc.dll]  [Intel Corporation, 3,0,0,1715]
    [C:\WINNT\System32\igfxhk.dll]  [Intel Corporation, 3,0,0,1715]
    [C:\WINNT\System32\igfxres.dll]  [Intel Corporation, 3,0,0,1715]
[PID: 1340][C:\OfficeScan NT\pccntmon.exe]  [Trend Micro Inc., 7.3.0.1028]
    [C:\OfficeScan NT\loadhttp.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\OfficeScan NT\Pwd.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\OfficeScan NT\OfcPlugInAPI.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\OfficeScan NT\OfcPIPC.dll]  [N/A, ]
    [C:\OfficeScan NT\TimeString.dll]  [N/A, ]
    [C:\WINNT\system32\AMInit.dll]  [Altiris Inc., 6, 0, 1024]
    [C:\OfficeScan NT\ntmonres.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\OfficeScan NT\OfcPlugInMain.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\OfficeScan NT\OfcPlugInTray.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\OfficeScan NT\tmdbg20.dll]  [trend_company_name, 1, 0, 0, 1]
    [C:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1480][C:\Program Files\Altiris\AClient\AClntUsr.EXE]  [, 6, 8, 161]
    [C:\WINNT\system32\AMInit.dll]  [Altiris Inc., 6, 0, 1024]
    [C:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1308][C:\WINNT\system32\ctfmon.exe]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\WINNT\system32\MSUTB.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\WINNT\system32\AMInit.dll]  [Altiris Inc., 6, 0, 1024]
    [C:\WINNT\mui\fallback\0804\msutb.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1088][D:\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINNT\system32\AMInit.dll]  [Altiris Inc., 6, 0, 1024]
    [C:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [C:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1336][D:\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINNT\system32\AMInit.dll]  [Altiris Inc., 6, 0, 1024]
    [C:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]

引用:

【xp123的贴子】【回复“SwireCocaCola”的帖子】你就不会分它几次传啊 ………………

大虾教导的是，已经传上来了，麻烦各位帮忙看看是啥问题，小弟感激不尽！！！

报告传上来了，好像没大虾解答。。。