求教各位大虾 mshcp.exe是否是病毒 bbs.ikaka.com

SwireCocaCola - 2007-5-9 12:06:00

求教各位大虾，本人机器里面有个mshcp.exe的进程老是占用80%以上的CPU，我的杀毒软件也查不出有病毒迹象，而且这个mshcp.exe进程无法强制关闭，请问是病毒吗？该怎么处理呢？谢谢啦~

火影忍者 - 2007-5-9 12:16:00

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改
日志一次发不完，请分次发上来

SwireCocaCola - 2007-5-9 14:25:00

引用:

【火影忍者的贴子】
下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改
日志一次发不完，请分次发上来
………………

大虾，
报告太长不修改的话上传不上来啊~

xp123 - 2007-5-9 14:34:00

【回复“SwireCocaCola”的帖子】你就不会分它几次传啊

SwireCocaCola - 2007-5-9 15:02:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Windows 2000 Publisher]
<IgfxTray><C:\WINNT\System32\igfxtray.exe> [Intel Corporation]
<HotKeysCmds><C:\WINNT\System32\hkcmd.exe> [Intel Corporation]
<ClocX><D:\ClocX.exe> [N/A]
<AeXAgentLogon><"C:\Program Files\Altiris\eXpress\NS Client\AeXAgentActivate.exe" /logon> [Altiris, Inc.]
<OfficeScanNT 监控程序><"C:\OfficeScan NT\pccntmon.exe" -HideWindow> [Trend Micro Inc.]
<HPLJ Config><C:\Program Files\Hewlett-Packard\LaserJet 33xx\hppcfg.exe /installparams> [N/A]
<AClntUsr><C:\Program Files\Altiris\AClient\AClntUsr.EXE> []
<Client Access Service><"C:\Program Files\IBM\Client Access\cwbsvstr.exe"> [IBM Corporation]
<Client Access Help Update><"C:\Program Files\IBM\Client Access\cwbinhlp.exe"> [IBM Corporation]
<Client Access Check Version><"C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN> [N/A]
<Client Access Express Welcome><"C:\Program Files\IBM\Client Access\cwbwlwiz.exe"> [IBM Corporation]
<Client Access PC5250 Sound><"C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe"> [IBM]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows 2000 Publisher]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><AMInit.dll> [Altiris Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Windows Media Player><C:\WINNT\System32\setup\wmpocm.exe /ShowWMP> [(Verified)Microsoft Windows 2000 Publisher]

==================================
启动文件夹
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>

==================================
服务
[Altiris Client Service / AClient][Running/Auto Start]
<C:\Program Files\Altiris\AClient\AClient.exe -service><Altiris, Inc.>
[Altiris Agent / AeXNSClient][Running/Auto Start]
<C:\Program Files\Altiris\eXpress\NS Client\AeXNSAgent.exe><Altiris, Inc.>
[iSeries Access for Windows Remote Command / Cwbrxd][Stopped/Manual Start]
<C:\WINNT\CWBRXD.EXE><IBM Corporation>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[DameWare Mini Remote Control / DWMRCS][Running/Auto Start]
<C:\WINNT\SYSTEM32\DWRCS.EXE -service><DameWare Development LLC>
[Machine Debug Manager / MDM][Running/Auto Start]
<"C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"><Microsoft Corporation>
[Microsoft DHCPA Service / Microsoft DHCPA Service][Running/Auto Start]
<"C:\WINNT\system32\dllcache\mshcp.exe"><N/A>
[OfficeScanNT 实时扫描 / ntrtscan][Running/Auto Start]
<"C:\OfficeScan NT\ntrtscan.exe"><Trend Micro Inc.>
[OfficeScanNT Personal Firewall / OfcPfwSvc][Running/Auto Start]
<"C:\OfficeScan NT\OfcPfwSvc.exe"><Trend Micro Inc.>
[OfficeScanNT 监听程序 / tmlisten][Running/Auto Start]
<"C:\OfficeScan NT\tmlisten.exe"><Trend Micro Inc.>

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Altiris Kernel Driver / AlKernel][Running/Manual Start]
<System32\Drivers\AlKernel.sys><N/A>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[Intel(R) PRO/1000 Adapter Driver / E1000][Running/Manual Start]
<System32\DRIVERS\e1000nt5.sys><Intel Corporation>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[OMCI / OMCI][Running/System Start]
<\SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS><Dell Computer Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[Trend Micro Filter / TmFilter][Running/Auto Start]
<\??\C:\OfficeScan NT\TmFilter.sys><Trend Micro Inc.>
[Common Firewall Driver / TM_CFW][Running/Auto Start]
<\??\C:\OfficeScan NT\tm_cfw.sys><Trend Micro Inc.>
[Trend Micro VSAPI NT / VSApiNt][Running/Auto Start]
<\??\C:\OfficeScan NT\VSApiNt.sys><Trend Micro Inc.>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/System Start]
<system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
<system32\drivers\ialmkchw.sys><Intel Corporation>

SwireCocaCola - 2007-5-9 15:03:00

==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\FLASH.OCX, Macromedia, Inc.>
[导出到 Microsoft Excel(&x)]
<res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>

==================================
正在运行的进程
[PID: 140][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.5382]
[PID: 164][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.5265]
[PID: 160][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6898]
[C:\WINNT\system32\AMInit.dll] [Altiris Inc., 6, 0, 1024]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.3649]
[C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[PID: 1408][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3502.5321]
[C:\WINNT\AppPatch\AcLayers.DLL] [Microsoft Corporation, 5.00.2195.5308]
[C:\WINNT\system32\AMInit.dll] [Altiris Inc., 6, 0, 1024]
[C:\WINNT\System32\msimtf.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\WINNT\System32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.3649]
[C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 6.0.1.2003110300]
[C:\WINNT\mui\fallback\0804\msctf.dll.mui] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\Program Files\Microsoft Office\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
[C:\WINNT\system32\msadp32.acm] [Microsoft Corporation, 5.00.2134.1]
[PID: 1856][C:\WINNT\SYSTEM32\DWRCST.exe] [DameWare Development, 4, 5, 0, 1]
[C:\WINNT\SYSTEM32\AMInit.dll] [Altiris Inc., 6, 0, 1024]
[C:\WINNT\SYSTEM32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.3649]
[C:\WINNT\system32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\WINNT\SYSTEM32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[PID: 1796][C:\WINNT\System32\hkcmd.exe] [Intel Corporation, 3,0,0,1715]
[C:\WINNT\System32\hccutils.DLL] [Intel Corporation, 3,0,0,1715]
[C:\WINNT\System32\AMInit.dll] [Altiris Inc., 6, 0, 1024]
[C:\WINNT\System32\igfxdev.dll] [Intel Corporation, 3,0,0,1715]
[C:\WINNT\system32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\WINNT\System32\igfxsrvc.dll] [Intel Corporation, 3,0,0,1715]
[C:\WINNT\System32\igfxhk.dll] [Intel Corporation, 3,0,0,1715]
[C:\WINNT\System32\igfxres.dll] [Intel Corporation, 3,0,0,1715]
[PID: 1340][C:\OfficeScan NT\pccntmon.exe] [Trend Micro Inc., 7.3.0.1028]
[C:\OfficeScan NT\loadhttp.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\OfficeScan NT\Pwd.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\OfficeScan NT\OfcPlugInAPI.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\OfficeScan NT\OfcPIPC.dll] [N/A, ]
[C:\OfficeScan NT\TimeString.dll] [N/A, ]
[C:\WINNT\system32\AMInit.dll] [Altiris Inc., 6, 0, 1024]
[C:\OfficeScan NT\ntmonres.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\OfficeScan NT\OfcPlugInMain.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\OfficeScan NT\OfcPlugInTray.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\OfficeScan NT\tmdbg20.dll] [trend_company_name, 1, 0, 0, 1]
[C:\WINNT\system32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1480][C:\Program Files\Altiris\AClient\AClntUsr.EXE] [, 6, 8, 161]
[C:\WINNT\system32\AMInit.dll] [Altiris Inc., 6, 0, 1024]
[C:\WINNT\system32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1308][C:\WINNT\system32\ctfmon.exe] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\WINNT\system32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\WINNT\system32\MSUTB.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\WINNT\system32\AMInit.dll] [Altiris Inc., 6, 0, 1024]
[C:\WINNT\mui\fallback\0804\msutb.dll.mui] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\WINNT\mui\fallback\0804\msctf.dll.mui] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1088][D:\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINNT\system32\AMInit.dll] [Altiris Inc., 6, 0, 1024]
[C:\WINNT\system32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[C:\WINNT\mui\fallback\0804\msctf.dll.mui] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1336][D:\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINNT\system32\AMInit.dll] [Altiris Inc., 6, 0, 1024]
[C:\WINNT\system32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

SwireCocaCola - 2007-5-9 15:04:00

引用:

【xp123的贴子】【回复“SwireCocaCola”的帖子】你就不会分它几次传啊
………………

大虾教导的是，已经传上来了，麻烦各位帮忙看看是啥问题，小弟感激不尽！！！

SwireCocaCola - 2007-5-10 12:07:00

报告传上来了，好像没大虾解答。。。

瑞星卡卡安全论坛