【求助】Service.exe 导致开机虚拟内存不足！

[freedomtempler]

小弟最近发现启动时内存不断上涨（察看是Service.exe占用的），CPU100%，直到虚拟内存不足为止（设置为2G）,提示虚拟内存不足后，就逐渐下降回复正­常。感觉不像病毒，搜索注册表未发现有service.exe的项，也没有在其他文件夹发现有异常的service.exe存在。我是XP Home版
杀毒软件一直在更新，所以不像是病毒。我跟踪services.exe发现里面有一个会消失的可疑线程。
在安全模式下面没有问题。但是诊断和正常模式下面不行。我也没有安装什么设备，应该不会是冲突吧。
在下已经黔驴技穷，希望各位大哥大姐帮助啊。google出来的方法基本都是杀毒，在我这都不行。

[freedomtempler]

写错了，不好意思，是services.exe
我用pe
Name Description Company Name
ncobjapi.dll Microsoft Corporation
oleaut32.dll Microsoft Corporation
unicode.nls
locale.nls
sortkey.nls
sorttbls.nls
ctype.nls
AppEvent.Evt
SecEvent.Evt
SysEvent.Evt
advapi32.dll Advanced Windows 32 Base API Microsoft Corporation
apphelp.dll Application Compatibility Client Library Microsoft Corporation
authz.dll Authorization Framework Microsoft Corporation
comctl32.dll Common Controls Library Microsoft Corporation
eventlog.dll Event Logging Service Microsoft Corporation
gdi32.dll GDI Client DLL Microsoft Corporation
lpk.dll Language Pack Microsoft Corporation
winmm.dll MCI API DLL Microsoft Corporation
msvcp60.dll Microsoft (R) C++ Runtime Library Microsoft Corporation
msacm32.dll Microsoft ACM Audio Filter Microsoft Corporation
ole32.dll Microsoft OLE for Windows Microsoft Corporation
uxtheme.dll Microsoft UxTheme Library Microsoft Corporation
netapi32.dll Net Win32 API DLL Microsoft Corporation
ntdll.dll NT Layer DLL Microsoft Corporation
psapi.dll Process Status Helper Microsoft Corporation
rpcrt4.dll Remote Procedure Call Runtime Microsoft Corporation
secur32.dll Security Support Provider Interface Microsoft Corporation
services.exe Services and Controller app Microsoft Corporation
shlwapi.dll Shell Light-weight Utility Library Microsoft Corporation
shimeng.dll Shim Engine DLL Microsoft Corporation
usp10.dll Uniscribe Unicode script processor Microsoft Corporation
comctl32.dll User Experience Controls Library Microsoft Corporation
userenv.dll Userenv Microsoft Corporation
umpnpmgr.dll User-mode Plug-and-Play Service Microsoft Corporation
version.dll Version Checking and File Installation Libraries Microsoft Corporation
AcGenral.dll Windows Compatibility DLL Microsoft Corporation
kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation
msvcrt.dll Windows NT CRT DLL Microsoft Corporation
scesrv.dll Windows Security Configuration Editor Engine Microsoft Corporation
shell32.dll Windows Shell Common Dll Microsoft Corporation
ws2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation
ws2help.dll Windows Socket 2.0 Helper for Windows NT Microsoft Corporation
wtsapi32.dll Windows Terminal Server SDK APIs Microsoft Corporation
imm32.dll Windows XP IMM32 API Client DLL Microsoft Corporation
user32.dll Windows XP USER API Client DLL Microsoft Corporation
winsta.dll Winstation Library Microsoft Corporation

[freedomtempler]

没有看见什么可疑的dll
只是在开机时我用ProcessExplorer找到了services里面有一个会消失的可疑线程
基本上就是这个线程占用了大量cpu时间
所以我觉得是什么东西调用services建立这个线程然后疯狂写Virtual Memory

[lj_ada]

是木马,你自己用分析大师检查一下就清楚了.

[log1123456]

就是可能是病毒，现在除了金山2006，应该能够杀那个了，木马也可以

[scz123]

双击查看该进程，看Threads里是哪个线程在消耗资源

[scz123]

推荐使用Process Explorer
http://www.sysinternals.com/Utilities/ProcessExplorer.html

选中这个可疑进程
view/lower panel viewer/dll：显示进程加载的DLL，自己诊断以下，或者
file/save as...: 把相关内容存成文本，然后贴到CSDN上，让大家诊断以下，

[fhqrhdw]

下个木马克星杀一下,有的杀毒软件根本杀不出密码!

[spark_li]

service.exe
明显木马(病毒)呀
services.exe才是系统进程

[freedomtempler]

我用的norton antivirus2006最新升级

我发现了那个线程，但是那个线程在系统稳定后就消失了

好像只有在启动时才会出现，当virtual memory 恢复正常后，该线程消失