瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 msmdsrv.exe是什么啊?我开机就占了100%的CPU……病毒?

123   2  /  3  页   跳转

msmdsrv.exe是什么啊?我开机就占了100%的CPU……病毒?

你先终止msmdsrv.exe这个进程,再找到C:\WINDOWS\SYSTEM32\PCANotify.dll
这个文件删除试试。
gototop
 

~~试了下,删不掉……
gototop
 

在安全模式下也删不掉…………
重启后进入一般模式,又是100%……
也许该把SQL 删了??…………
到底怎么回事啊………………!!
gototop
 

用优化大师里的进程管理看了看,进程winlogon.exe有调用PCANotify.dll
优先级为高
有问题吗?
gototop
 

用Autoruns保存一个日志发上来
日志保存方法:选择File->Save菜单项
保存日志时注意选择Options->Hide Microsoft Entries菜单项

工具使用参考http://forum.ikaka.com/topic.asp?board=28&artid=7318038
gototop
 

……………………
gototop
 

发错了的
gototop
 

同上……发错的
删了
gototop
 

太多了
保存日志时注意选择Options->Hide Microsoft Entries菜单项
gototop
 

……我记得我明明选了的啊……
这个应该对了吧

HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon

+ Local Group PolicyFile not found: C:\WINDOWS\System32\GroupPolicy\User\disshare.bat

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

+ ATIPTAATI Desktop Control PanelATI Technologies, Inc.c:\program files\ati technologies\ati control panel\atiptaxx.exe

+ RavMonRavMon Rising realtime monitor Beijing Rising Technology Co., Ltd.c:\program files\rising\rav\ravmon.exe

+ RavTimerRavTimerBeijing Rising Technology Co., Ltd.c:\program files\rising\rav\ravtimer.exe

+ RfwMainRising Personal FireWall Main ProgramBeijing Rising Technology Corporation Limitedc:\program files\rising\rfw\rfwmain.exe

+ StormCodec_Helperf:\tool\stormcodec\storm codec\stormset.exe

HKLM\System\CurrentControlSet\Services

+ Ati HotKey Pollerc:\windows\system32\ati2evxx.exe

+ ATI SmartATI Smartc:\windows\system32\ati2sgag.exe

+ Autodesk Licensing ServiceAnchor service for Autodesk products licensed with SafeCastAutodesk, Inc.c:\program files\common files\autodesk shared\service\adskscsrv.exe

+ RfwServiceRising Personal Firewall ServiceBeijing Rising Technology Corporation Limitedc:\program files\rising\rfw\rfwsrv.exe

+ RsCCenterCCenterrisingc:\program files\rising\rav\ccenter.exe

+ RsRavMonRavMonBeijing Rising Technology Co., Ltd.c:\program files\rising\rav\ravmond.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved

+ RISINGRising Shell Ext ModuleBeijing Rising Technology Co., Ltd.c:\windows\system32\ravext.dll

+ 好看123上网精灵超级兔子上网精灵超级兔子f:\魔法兔子\magicset\haokanbar.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

+ ThunderIEHelper ClassThunderBHO Modulec:\windows\system32\thunderbho_v07.dll

+ 超级兔子上网精灵超级兔子上网精灵超级兔子f:\魔法兔子\magicset\haokanbar.dll

HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks

+ coolbar\

HKLM\Software\Microsoft\Internet Explorer\Toolbar

+ 超级兔子上网精灵超级兔子上网精灵超级兔子f:\魔法兔子\magicset\haokanbar.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

+ AtiExtEventc:\windows\system32\ati2evxx.dll

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors

+ pcAnywhere Remote PrintingpcAnywhere Monitor DLLSymantec Corporationc:\windows\system32\awmon.dll

gototop
 
123   2  /  3  页   跳转
页面顶部
Powered by Discuz!NT