紧急救援～　高手请进～　关于ｗｉｎ２００程序自动关闭的问题～
mouster 19:11:51
打开我要开的一个程序 那个程序不会有反映
mouster 19:12:03
在系统进程里面可以看到他 但是只占用48K的内存
mouster 19:12:16
而且没反映过后 文件夹会自动关闭
mouster 19:12:22
所有的文件夹
北京新鑫互联 19:12:28
哦

请下载使用 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
www.27814939.ys168.com

日志是这样的
2006-05-03,08:24:52

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows 2000 Server Service Pack 4 - Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
    All Boot Items (Including Registry, Startup Folders, Services and so on)
    Browser Add-ons
    Runing Processes (Including process model information)
    File Associations


Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <internat.exe><internat.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINNT\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>

==================================
Startup Folders
[服务管理器]
  <C:\Documents and Settings\All Users\Start Menu\Programs\Startup\服务管理器.lnk><N>

==================================
Services
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>

==================================
Browser Add-ons
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[&Radio]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, N/A>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\System32\wuweb.dll, Microsoft Corporation>
[MUWebControl Class]
  {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINNT\system32\muweb.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[&ê1ó???à×????]
  <{D27CDB6E-AE6D-11CF-96B8-444553540000}, N/A>
[&ê1ó???à×????è?2?á′?ó]
  <, N/A>
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>

==================================
Running Processes
[PID: 176][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 200][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
    [C:\WINNT\TEMP\lg2.dll]  <N/A><N/A>
[PID: 224][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6997>
[PID: 252][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.7035>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 264][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.7011>
[PID: 364][C:\WINNT\System32\termsrv.exe]  <Microsoft Corporation><5.00.2195.6696>
[PID: 496][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 540][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.7059>
[PID: 588][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 692][C:\WINNT\System32\llssrv.exe]  <Microsoft Corporation><5.00.2195.7021>
[PID: 728][C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe]  <Microsoft Corporation><2000.080.0194.00>
[PID: 848][C:\WINNT\system32\regsvc.exe]  <Microsoft Corporation><5.00.2195.6701>
[PID: 872][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6972>
[PID: 924][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 956][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 976][C:\WINNT\system32\Dfssvc.exe]  <Microsoft Corporation><5.00.2195.6664>
[PID: 1016][C:\WINNT\System32\inetsrv\inetinfo.exe]  <Microsoft Corporation><5.00.0984>
[PID: 1036][C:\WINNT\System32\msdtc.exe]  <Microsoft Corporation><1999.9.3421.3>
[PID: 1140][C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe]  <Microsoft Corporation><9.107.5512.0>
[PID: 1592][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 552][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 1008][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6997>
[PID: 1700][C:\WINNT\system32\rdpclip.exe]  <Microsoft Corporation><5.00.2174.1>
[PID: 1428][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
[PID: 1356][C:\WINNT\system32\internat.exe]  <Microsoft Corporation><5.00.2920.0000>
[PID: 1764][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe]  <Microsoft Corporation><2000.080.0194.00>
[PID: 1552][C:\Documents and Settings\Administrator\Desktop\System Repair Engineer v2.0.12.350 RC-PCPOP\SREng.exe]  <Smallfrogs Studio><2.0.12.350>

==================================
File Associations
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider

==================================

首先从日志看出你电脑很多问题！
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  首先系统不会开机自己启动 Explorer.exe
Startup Folders
[服务管理器]

<C:\Documents and Settings\All Users\Start Menu\Programs\Startup\服务管理器.lnk><N>
这个不知道什么东西？

C:\WINNT\TEMP\lg2.dll] <N/A><N/A>
[PID: 224][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6997>
？？是什么意思啊

这个是服务器 Winlogon有的说是病毒 有的说是远程登陆的。我确实是远程登陆服务器的。但是这个Winlogon有两个 所以请哪位大大能发表下高见

进程里有这么一项[C:\WINNT\TEMP\lg2.dll] <N/A><N/A>
下载SSM，用它来禁用它插入其它进程
SSM在反病毒论坛里有很多相关的教程
另外，如果方便，能否把这个TEMP打包给我twtxk@126.com(如果太大，可以把TEMP里的东东能删除的都删除掉)谢谢，祝你好运。