可以确定你机流氓软件和病毒共存，由于对一些监控软件不熟悉，将一些嫌疑比较大的问题项目罗列下：
=================================
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Firewall auto setup><C:\DOCUME~1\USER\LOCALS~1\Temp\winlogon.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<z3iyc7b><rundll32 "C:\WINDOWS\Downlo~1\z3iyc7b.dll",start> [Microsoft Corporation]
<ln0d8no><rundll32 "C:\WINDOWS\Downlo~1\ln0d8no.dll",Run> [Microsoft Corporation]
==================================
服务
[COM+ Service Process Manager / COMLoader32][Running/Auto Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->c:\windows\inf\camdrvs.inf><Microsoft Corporation>
[DCOM Service Process Manager / COMROMLoader64][Running/Auto Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->c:\windows\inf\dvdromdrvs.inf><Microsoft Corporation>
[FCI / FCI][Stopped/Auto Start]
<C:\WINDOWS\system32\svchost.exe:ext.exe><N/A>
[ICF / ICF][Stopped/Auto Start]
<C:\WINDOWS\system32\svchost.exe:exe.exe><N/A>
[ms_2fax / ms_2fax][Running/Auto Start]
<C:\WINDOWS\system32\f10c1.exe><Microsoft Corporation>
[Secondary Logon / seclogon][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->c:\windows\system32\com\pmmdqcgci.dll><N/A>
[System Event loader / sysloader][Stopped/Auto Start]
<"C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe"><Microsoft>
[Portable Media Serial Number Services / WmdmPmSNs][Stopped/Auto Start]
<C:\WINDOWS\system32\rxjh_2.exe><N/A>
==================================
驱动程序
[apcdli / apcdli][Running/Auto Start]
<\??\C:\Program Files\Microsoft Office\SYSTEM\apcdli.sys><>
[Test Info / bkckrtdl][Stopped/Boot Start]
<\SystemRoot\system32\drivers\bkckrtdl.sys><N/A>
[x63 / x63q][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\x63q.sys><N/A>
==================================
浏览器加载项
[Invoke Class]
{0EAF6278-BD19-4153-BA3B-9B850F31E67B} <C:\WINDOWS\system32\7f11.dll, >
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[Info cache]
{385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, N/A>
[BHOobj Class]
{3CF67E17-3AF1-4813-88B9-F3B2490D2216} <C:\WINDOWS\system32\KIE.dll, N/A>
[]
{4D2EAF15-81D0-42DA-8C39-19EDD39E0FB3} <C:\WINDOWS\system32\hdnodmzhjt.dll, N/A>
[e404mgr Class]
{A3D76B96-30B9-4DCC-9B3D-D12E31280D29} <C:\Program Files\Helper\1204089417.dll, >
[Adobe Common Objects]
{C86488AF-13D5-4FEF-9DDF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_3105.dll, N/A>
[Invoke Class]
{0EAF6278-BD19-4153-BA3B-9B850F31E67B} <C:\WINDOWS\system32\7f11.dll, >
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[Info cache]
{385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, N/A>
[BHOobj Class]
{3CF67E17-3AF1-4813-88B9-F3B2490D2216} <C:\WINDOWS\system32\KIE.dll, N/A>
[]
{4D2EAF15-81D0-42DA-8C39-19EDD39E0FB3} <C:\WINDOWS\system32\hdnodmzhjt.dll, N/A>
[e404mgr Class]
{A3D76B96-30B9-4DCC-9B3D-D12E31280D29} <C:\Program Files\Helper\1204089417.dll, >
[Adobe Common Objects]
{C86488AF-13D5-4FEF-9DDF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_3105.dll, N/A>
==================================
正在运行的进程
[c:\windows\system32\com\pmmdqcgci.dll] [N/A, ]
[c:\windows\system32\usmt\jjfavxbnl.dll] [Microsoft Crop., 6.0.3.425]
[c:\windows\inf\msdvdload.exe] [N/A, ]
[C:\WINDOWS\Downlo~1\ln0d8no.dll] [Microsoft Corporation, 5, 3, 2600, 2180]
[C:\WINDOWS\Downlo~1\z3iyc7b.dll] [Microsoft Corporation, 5, 3, 2600, 2180]
[c:\windows\inf\dvdromdrvs.inf] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[c:\windows\inf\camdrvs.inf] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\7f11.dll] [, 1, 0, 0, 2]
[C:\WINDOWS\system32\7f11.dll] [, 1, 0, 0, 2]
[C:\Program Files\Helper\1204089417.dll] [, 1, 0, 0, 1]
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 20248, C:\WINDOWS\SYSTEM32\USMT\7895\SVCHOST.EXE]
==================================
隐藏进程
[3132] C:\DOCUME~1\USER\LOCALS~1\Temp\winlogon.exe
==================================
【注】个人以为C:\Program Files\wrkwn60\windlwork.dll这个进程是VNC软件释放的监控软件核心组件，请确认是否是网络管理员安装的监控进程软件先……
