瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】我怎么有7个svchost.exe进程啊?

1   1  /  1  页   跳转

【求助】我怎么有7个svchost.exe进程啊?

【求助】我怎么有7个svchost.exe进程啊?

最近电脑莫名其妙CPU利用率100%
    查看任务管理器发现,占用CPU的罪魁祸首就是1个svchost.exe,同时发现以前只有5个svchost.exe进程,结果现在有7个....
    请各位达人高手帮我看看...为什么我用Hijackthis查却只有4个svchost.exe进程

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
E:\瑞星杀毒\RAV\Ravmond.exe
e:\瑞星杀毒\rfw\rfwsrv.exe
C:\WINDOWS\system32\crypserv.exe
E:\瑞星杀毒\RAV\CCENTER.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
e:\瑞星杀毒\rfw\RfwMain.exe
E:\瑞星杀毒\RAV\RAVTIMER.EXE
E:\瑞星杀毒\RAV\RAVMON.EXE
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\宽带\Huawei-3Com\H3C 802.1X 客户端\Dot1XClient.exe
C:\TDdownload\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: (no name) - {046167AA-53C2-4576-B362-291D9E852269} - C:\WINDOWS\system32\BBDown.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - E:\QQ2003\qq\QQIEHelper.dll
O2 - BHO: SnapFlash Class - {A44CBB0B-C77D-4BF5-87CC-B4EE79AD1B7E} - d:\Program Files\justDo\FlashSaver\Jd2002.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: IEHlprObj Class - {C5E5DB7E-46B1-47E6-8447-2E517F269925} - C:\Program Files\Xplus\GETIE.dll
O2 - BHO: (no name) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - (no file)
O3 - Toolbar: (no name) - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RavTimer] E:\瑞星杀毒\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RfwMain] "E:\瑞星杀毒\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavMon] E:\瑞星杀毒\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DrvMon.exe] C:\WINDOWS\system32\DrvMon.exe
O8 - Extra context menu item: &使用迅雷下载 - E:\下载\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - E:\下载\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\QQ2003\qq\AddToNetDisk.htm
O8 - Extra context menu item: 下载页面上的ED2(&K)链接 - E:\电驴\eMule\ed2k.html
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 导出当前页到超星阅览器(&A) - D:\Program Files\SSREADER36\ss_all.htm
O8 - Extra context menu item: 导出选中部分到超星阅览器(&S) - D:\Program Files\SSREADER36\ss_select.htm
O8 - Extra context menu item: 收藏此页到ViVi - http://vivi.sina.com.cn/collect/click.php?agent=ddt
O8 - Extra context menu item: 新浪搜索 - http://cha.sina.com.cn/ddt.html
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\QQ2003\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\QQ2003\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\QQ2003\qq\SendMMS.htm
O8 - Extra context menu item: 闪客精灵 - E:\硕思闪客精灵\InternetExplorer.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\浩方平台\浩方对战平台\GameClient.exe
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\QQ2003\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\QQ2003\qq\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\QQ2003\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\QQ2003\qq\QQIEHelper.dll
O9 - Extra button: 闪客精灵 - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - E:\硕思闪客精灵\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: 闪客精灵 - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - E:\硕思闪客精灵\InternetExplorer.htm
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {045ADB92-9635-45CE-B25B-F19F825B0E39} (MSTPlayerInstaller Control) - http://211.151.89.101/MSTPlayer/CHS/MSTPlayerInstaller.ocx
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://cge.hn.chinavnet.com/plugin/PowerPlr.ocx
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://www.ppstream.com/bin/powerplayer.cab
O16 - DPF: {62561858-71D1-11D4-B2EC-00105A8340B5} (VITEGPlayerCtrl Class) - http://www.lt21.com.cn/control/VTPlayer.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.238.249.168/activex/AxisCamControl.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O16 - DPF: {E75D308D-B903-11D4-BD46-0050BA6E0CA5} (BtecKBase Class) - http://www.drcnet.com.cn/fish_dll/bteckbasec.dll
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://tenpay.qq.com/download/qqedit.cab
O20 - AppInit_DLLs: APIHookDll.dll
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - e:\瑞星杀毒\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - E:\瑞星杀毒\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\瑞星杀毒\RAV\Ravmond.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

最后编辑2005-11-06 09:16:14
分享到:
gototop
 

那个svchost.exe进程的路径是多少。能不能关闭这个进程。
gototop
 

以下是用procexp.exe软件检查保存的文件
ProcessPIDCPUDescriptionCompany Name
System Idle Process095.52
Interruptsn/aHardware Interrupts
DPCsn/a1.49Deferred Procedure Calls
System4
  SMSS.EXE536Windows NT Session ManagerMicrosoft Corporation
  CSRSS.EXE612Client Server Runtime ProcessMicrosoft Corporation
  WINLOGON.EXE636Windows NT Logon ApplicationMicrosoft Corporation
    SERVICES.EXE6801.49Services and Controller appMicrosoft Corporation
    SVCHOST.EXE848Generic Host Process for Win32 ServicesMicrosoft Corporation
      TIMPlatform.exe1212TIMPlatformtencent
    SVCHOST.EXE912Generic Host Process for Win32 ServicesMicrosoft Corporation
    SVCHOST.EXE1016Generic Host Process for Win32 ServicesMicrosoft Corporation
      wscntfy.exe1248Windows Security Center Notification AppMicrosoft Corporation
    SVCHOST.EXE1108Generic Host Process for Win32 ServicesMicrosoft Corporation
    SVCHOST.EXE1184Generic Host Process for Win32 ServicesMicrosoft Corporation
    RavMonD.exe1284RavMonBeijing Rising Technology Co., Ltd.
    rfwsrv.exe1364Rising Personal FireWall ServiceBeijing Rising Technology Corporation Limited
      RfwMain.exe392Rising Personal FireWall Main ProgramBeijing Rising Technology Corporation Limited
    Crypserv.exe1604CrypKey NT ServiceKenonic Controls Ltd.
    CCenter.exe1740CCenterrising
    SVCHOST.EXE1812Generic Host Process for Win32 ServicesMicrosoft Corporation
    WDFMGR.EXE1832Windows User Mode Driver ManagerMicrosoft Corporation
    alg.exe1656Application Layer Gateway ServiceMicrosoft Corporation
    SVCHOST.EXE1764Generic Host Process for Win32 ServicesMicrosoft Corporation
    LSASS.EXE692LSA Shell (Export Version)Microsoft Corporation
    taskmgr.exe812Windows TaskManagerMicrosoft Corporation
EXPLORER.EXE472Windows ExplorerMicrosoft Corporation
RavTimer.exe308RavTimerBeijing Rising Technology Co., Ltd.
RavMon.exe268RavMon Rising realtime monitor Beijing Rising Technology Co., Ltd.
VM_STI.EXE580Still Image (STI) DriverVM.
rundll32.exe608Run a DLL as an AppMicrosoft Corporation
SOUNDMAN.EXE600Avance Sound ManagerAvance Logic, Inc.
ctfmon.exe596CTF LoaderMicrosoft Corporation
IEXPLORE.EXE2608Internet ExplorerMicrosoft Corporation
Dot1XClient.exe2848
QQPetBonne.exe2252Forevers
procexp.exe10801.49Sysinternals Process ExplorerSysinternals

conime.exe2648Console IMEMicrosoft Corporation

Process: SVCHOST.EXE Pid: 912

TypeName
Desktop\Default
Directory\Windows
Directory\BaseNamedObjects
Directory\KnownDlls
Event\BaseNamedObjects\crypt32LogoffEvent
Event\BaseNamedObjects\ScmCreatedEvent
FileC:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9
FileC:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9
File\Device\Tcp
File\Device\Afd\Endpoint
File\Device\Afd\Endpoint
File\Device\NamedPipe\Winsock2\CatalogChangeListener-390-0
File\Device\Afd\Endpoint
File\Device\Afd\Endpoint
File\Device\Tcp
File\Device\Tcp
File\Device\Ip
File\Device\Ip
File\Device\Ip
File\Device\Tcp
File\Device\Afd\Endpoint
File\Device\NamedPipe\epmapper
File\Device\NamedPipe\epmapper
File\Device\KsecDD
FileC:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9
File\Device\NamedPipe\net\NtControlPipe3
FileC:\WINDOWS\system32\
File\Dfs
KeyHKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
KeyHKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
KeyHKU\S-1-5-20
KeyHKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings
KeyHKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
KeyHKLM
KeyHKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage
KeyHKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters
KeyHKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
KeyHKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters
KeyHKCR
KeyHKCR
KeyHKLM\SOFTWARE\Microsoft\COM3
KeyHKU
KeyHKCR
KeyHKU
KeyHKLM\SOFTWARE\Microsoft\COM3
KeyHKLM\SOFTWARE\Microsoft\COM3
KeyHKCR\CLSID
KeyHKCR
KeyHKLM\SOFTWARE\Microsoft\COM3
KeyHKU
KeyHKLM\SOFTWARE\Microsoft\COM3
KeyHKLM\SOFTWARE\Microsoft\COM3
KeyHKCR\CLSID
KeyHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
KeyHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
KeyHKU\S-1-5-20_CLASSES
KeyHKCR\CLSID
KeyHKCR\AppID
KeyHKLM\SOFTWARE\Microsoft\Ole
KeyHKLM\SOFTWARE\Microsoft\Ole
KeyHKLM\SOFTWARE\Policies
KeyHKLM\SOFTWARE\Policies
KeyedEvent\KernelObjects\CritSecOutOfMemoryEvent
Mutant\BaseNamedObjects\ZonesCacheCounterMutex
Mutant\BaseNamedObjects\ZonesCounterMutex
Mutant\BaseNamedObjects\ZonesLockedCacheCounterMutex
Port\RPC Control\epmapper
Process(1212)
Section\BaseNamedObjects\__R_000000000007_SMem__
Semaphore\BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
Semaphore\BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
ThreadSVCHOST.EXE(912): 936
ThreadSVCHOST.EXE(912): 920
ThreadSVCHOST.EXE(912): 956
ThreadSVCHOST.EXE(912): 956
ThreadSVCHOST.EXE(912): 932
ThreadSVCHOST.EXE(912): 932
ThreadSVCHOST.EXE(912): 2668
ThreadSVCHOST.EXE(912): 2708
ThreadSVCHOST.EXE(912): 452
ThreadSVCHOST.EXE(912): 916
ThreadSVCHOST.EXE(912): 920
ThreadSVCHOST.EXE(912): 924
ThreadSVCHOST.EXE(912): 932
TokenNT AUTHORITY\SYSTEM
TokenMEISEN\梅尔吉仆森
TokenNT AUTHORITY\LOCAL SERVICE
TokenNT AUTHORITY\SYSTEM
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenNT AUTHORITY\SYSTEM
TokenNT AUTHORITY\SYSTEM
TokenNT AUTHORITY\LOCAL SERVICE
TokenNT AUTHORITY\SYSTEM
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
TokenMEISEN\梅尔吉仆森
WindowStation\Windows\WindowStations\Service-0x0-3e4$
WindowStation\Windows\WindowStations\Service-0x0-3e4$
gototop
 

以前每次出现svchost.exe占用CPU100%时候,我都是在任务管理器里面,直接结束进程...然后电脑就恢复正常了,因为太忙,也没有仔细查,结果每天开机一会儿就出现上面的情况,然后就结束svchost.exe进程!今天有时间就来卡卡,请教各位了......到底是怎么了啊?
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT