在安全模式下，诺盾杀了一个病毒，但重启后，出现内存不能写之类的错误，再后来，发现病毒防火墙就不能运行了，老出现自动打开一个网页，后来安360安全助手也不能用。现象大侠们求助！唉，怎么没有一个全能的杀毒软件呢！我们工作室，现在什么杀毒软件都用（全是正版的哈），就是这样，这个能杀，那个不能杀，那个能杀，这个不能杀！不过诺盾没有在线帮助这个，国外的就是国外的，不是专门服务中国人的！真是可恶！

各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 2005-12-30  23:35:00
诊断平台: Microsoft Windows XP  Service Pack 2
IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180
计算机物理内存: 2GB - 当前可用内存: 2GB

100 - 高危险 - Process: IEXPLORE.EXE [怀疑为恶意程序或病毒，请使用杀毒软件进行查杀。] - C:\WINDOWS\IEXPLORE.EXE
O4 - 高危险 - HKLM\..\Run: [System] [疑为恶意程序或病毒。] C:\Program Files\Common Files\system\Updaterun.exe
O6 - 低危险 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
O6 - 低危险 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: IEXPLORE.EXE [] -
100 - 未知 - Process: WinSys2.exe [TODO: <File description>] - C:\WINDOWS\system32\winsys2.exe
100 - 未知 - Process: Updaterun.exe [] - C:\Program Files\Common Files\system\Updaterun.exe
100 - 未知 - Process: W1NL0GON.EXE [] - C:\WINDOWS\W1NL0GON.EXE
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: c9251.exe [] - C:\WINDOWS\system32\c9251.exe
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: debug.exe [] - C:\WINDOWS\debug\debug.exe C:\WINDOWS\system32\conime.exe
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
100 - 未知 - Process: rundll32.exe [Player 动态链接库] - C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\551.dll,Always
R0 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.126.com/
R1 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
O1 - 未知 - Host: 127.0.0.1 locator.metadata.windowsmedia.com
O1 - 未知 - Host: 127.0.0.1 onlinestore.smgbb.cn
O2 - 未知 - BHO: (浏览器辅助对象(BHO)) - [NcoBHO] - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - 未知 - BHO: (ff Class) - [TODO: <文件说明>] - {FAAAC0F6-94BE-4466-934B-7C53666A2F41} - C:\WINDOWS\system32\5c91.dll
O3 - 未知 - Toolbar: (显示 Norton 工具栏) - [UIBhoImpl] - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - 未知 - HKLM\..\Run: [SkyTel] [Realtek Voice  Manager] SkyTel.EXE
O4 - 未知 - HKLM\..\Run: [SW20] [sw20 MFC Application] C:\WINDOWS\system32\sw20.exe
O4 - 未知 - HKLM\..\Run: [SW24] [] C:\WINDOWS\system32\sw24.exe
O4 - 未知 - HKLM\..\Run: [WinSys2] [TODO: <File description>] C:\WINDOWS\system32\winsys2.exe
O4 - 未知 - HKLM\..\Run: [osCheck] [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - 未知 - HKCU\..\Run: [MS Reporter(dont disable)] [] C:\WINDOWS\W1NL0GON.EXE
O8 - 未知 - Extra context menu item: 上传到QQ网络硬盘 - \\W01\1号机d盘\Program Files\Tencent\qq\AddToNetDisk.htm
O8 - 未知 - Extra context menu item: 使用迅雷下载 -
O8 - 未知 - Extra context menu item: 使用迅雷下载全部链接 -
O8 - 未知 - Extra context menu item: 添加到QQ自定义面板 - \\W01\1号机d盘\Program Files\Tencent\qq\AddPanel.htm
O8 - 未知 - Extra context menu item: 添加到QQ表情 - \\W01\1号机d盘\Program Files\Tencent\qq\AddEmotion.htm
O8 - 未知 - Extra context menu item: 用QQ彩信发送该图片 - \\W01\1号机d盘\Program Files\Tencent\qq\SendMMS.htm
O9 - 未知 - Extra button: 腾讯QQ(HKLM) -
O9 - 未知 - Extra button: 雨林木风(HKCU) - http://www.ylmf.com
O22 - 未知 - Filename Extention: .scr - "C:\WINDOWS\system32\notepad.exe" "%1"
O23 - 未知 - Service: 2F7440E1 [DFBB09E1] - C:\WINDOWS\system32\EFA23A4B.EXE -d - (not running)
O23 - 未知 - Service: 43628EA1 [7841ACB9] - C:\WINDOWS\system32\33F1F382.EXE -k - (not running)
O23 - 未知 - Service: 4530D85E [78ED86F2] - C:\WINDOWS\system32\EEF66012.EXE -g - (not running)
O23 - 未知 - Service: 68376D16 [0F53F103] - C:\WINDOWS\system32\3043F183.EXE -68376D16 - (not running)
O23 - 未知 - Service: ccEvtMgr [事件扩展和记录服务] - "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon - (not running)
O23 - 未知 - Service: ccSetMgr [设置存储和管理服务] - "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon - (not running)
O23 - 未知 - Service: CLTNetCnService [Symantec Lic NetConnect Service] - "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon - (not running)
O23 - 未知 - Service: comHost [COM aggregation host service] - "C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe" - (not running)
O23 - 未知 - Service: ISPwdSvc [用户帐户管理服务] - "C:\Program Files\Norton Internet Security\isPwdSvc.exe" - (not running)
O23 - 未知 - Service: LiveUpdate [LiveUpdate 核心引擎] - "C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE" - (not running)
O23 - 未知 - Service: netlog [Net Login Helper] - C:\WINDOWS\system32\SCardSer.exe - (not running)
O23 - 未知 - Service: SymAppCore [Symantec Application Service] - "C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe" - (not running)
O23 - 未知 - Service: Templates [Windows 网络通讯引擎，提供高效稳定的网络通讯服务。无法终止此服务。] - C:\WINDOWS\system32\slhyh.dll - (running)
O23 - 未知 - Service: 自动 LiveUpdate 调度程序 [管理对自动 LiveUpdate 会话的调度] - "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" - (running)
O23 - 未知 - Service: ms_2fax [Fax 2Client] - C:\WINDOWS\system32\c9251.exe - (running)

=======================================

100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService
100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\WINDOWS\..\Progra~1\Intern~1\IEXPLORE.EXE
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.exe
100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\WINDOWS\..\Progra~1\Intern~1\IEXPLORE.EXE
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe
100 - 安全 - Process: AdskScSrv.exe [autodesk公司相关软件的认证许可服务程序。] - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\WINDOWS\..\Progra~1\Intern~1\IEXPLORE.EXE
100 - 安全 - Process: inetinfo.exe [microsoft internet infomation services (iis)的一部分，用于debug调试除错。] - C:\WINDOWS\system32\inetsrv\inetinfo.exe
100 - 安全 - Process: nvsvc32.exe [nvidia driver helper service在nvida显卡驱动中被安装。] - C:\WINDOWS\system32\nvsvc32.exe
100 - 安全 - Process: ALUSchedulerSvc.exe [赛门铁克出品的防病毒软件。] - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
100 - 安全 - Process: RTHDCPL.EXE [瑞昱出品的声卡相关程序。] - C:\WINDOWS\RTHDCPL.EXE
100 - 安全 - Process: ccApp.exe [symantec公用应用客户端包含在norton antivirus 2003和norton personal firewall 2003。] - C:\Program Files\Common Files\Symantec Shared\ccApp.exe
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: wuauclt.exe [windows操作系统后台程序，用于系统升级。] - C:\WINDOWS\system32\wuauclt.exe
100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\Program Files\Internet Explorer\iexplore.exe
100 - 安全 - Process: wscript.exe [脚本语言的通用脚本主机(windows scripting host),基于windows的主机运行脚本程序。] - C:\WINDOWS\System32\WScript.exe
100 - 安全 - Process: cmd.exe [windows控制台程序。不像旧的command.com，cmd.exe是一个32位的命令行使用在winnt/2000/xp。] - C:\WINDOWS\system32\cmd.exe
100 - 安全 - Process: 诊断报告工具.exe [ReportTool Microsoft 基础类应用程序] - C:\Documents and Settings\Administrator\桌面\CheckTool\诊断报告工具.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
O2 - 安全 - BHO: (AcroIEHlprObj Class) - [Adobe Reader， 查看和打印 Adobe 便携文档格式 (PDF) 文件。] - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - 安全 - BHO: (CAdLogic Object) - [搜狗工具条相关文件。] - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Common Files\CPUSH\cpush.dll
O2 - 安全 - BHO: (腾讯QQ) - [腾讯QQ的一个插件。] - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\WINDOWS\QQIEHelper.dll
O4 - 安全 - HKLM\..\Run: [RTHDCPL] [realtek声卡特性设置软件相关程序。] RTHDCPL.EXE
O4 - 安全 - HKLM\..\Run: [Alcmtr] [一款声卡相关程序。] ALCMTR.EXE
O4 - 安全 - HKLM\..\Run: [NvCplDaemon] [是NVIDIA显示卡相关动态链接库文件。] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 安全 - HKLM\..\Run: [nwiz] [是NVidia的Nview特性相关程序。该程序用于用户对其特性进行配置，将桌面扩展到多台显示器上。 ] nwiz.exe /install
O4 - 安全 - HKLM\..\Run: [NvMediaCenter] [是NVidia显示卡相关文件。] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - 安全 - HKLM\..\Run: [ccApp] [诺顿杀毒或诺顿防火墙客户端软件] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O4 - 安全 - HKCU\..\Run: [bgswitch] [微软出品的自动换壁纸程序。] C:\WINDOWS\system32\bgswitch.exe
O4 - 安全 - Startup folder: [Adobe Gamma Loader.lnk] [adobe用于加载图形参数] C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk
O4 - 安全 - Startup folder: [AutoCAD 启动加速器.lnk] [autocad启动加速器。] C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AutoCAD 启动加速器.lnk
O8 - 安全 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 - 安全 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (Windows升级工具V5) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146048350173
O16 - 安全 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Flash播放器) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - 安全 - Protocol: OFFICE 相关 - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - 安全 - Service: Autodesk Licensing Service [Autodesk的服务程序。] - "C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe" - (running)
O23 - 安全 - Service: NVSvc [是NVIDIA显示卡相关程序。] - C:\WINDOWS\system32\nvsvc32.exe - (running)
O23 - 安全 - Service: Symantec Core LC [诺顿2006相关服务] - "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe" - (not running)

=======================================

O40 - csrss.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - csrss.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - winlogon.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - winlogon.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - winlogon.exe - Microsoft Corporation - C:\WINDOWS\system32\78ED86F2.DLL -  - 2d631836e23d7a43494d37d62f240d64
O40 - winlogon.exe - Microsoft Corporation - C:\WINDOWS\system32\0F53F103.DLL -  - cdaba8d1b910fe5acde30008f2cd83e4
O40 - services.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - services.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - lsass.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - lsass.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - svchost.exe -  - C:\WINDOWS\system32\comwspn.dll -  - c593095717f77e1e7ef01c6708b673f7
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - svchost.exe - Microsoft Corporation - c:\windows\system32\slhyh.dll - szdj - ec3a62219cba761233c52f17ed63b191
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - rundll32.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - Explorer.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - Explorer.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - Explorer.exe - Microsoft Corporation - C:\WINDOWS\system32\0F53F103.DLL -  - cdaba8d1b910fe5acde30008f2cd83e4
O40 - Explorer.exe - Microsoft Corporation - C:\WINDOWS\system32\78ED86F2.DLL -  - 2d631836e23d7a43494d37d62f240d64
O40 - Explorer.exe - Microsoft Corporation - C:\WINDOWS\system32\MSVCP71.dll - Microsoft? C++ Runtime Library - 561fa2abb31dfa8fab762145f81667c2
O40 - Explorer.exe - Microsoft Corporation - C:\WINDOWS\system32\MSVCR71.dll - Microsoft? C Runtime Library - 86f1895ae8c5e8b17d99ece768a70732
O40 - Explorer.exe - TODO: <公司名> - C:\WINDOWS\system32\5c91.dll - TODO: <文件说明> - ca64b102b080ea10587fda7457bf3311
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe - Microsoft Corporation - C:\WINDOWS\system32\7841ACB9.DLL -  - bf3ca4fe7d147240b2bdf0a1df6a42bd
O40 - rundll32.exe - Microsoft Corporation - C:\WINDOWS\system32\DFBB09E1.DLL -  - c147810c7d76706ada551cd8c9c72a58
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31
O40 - rundll32.exe -    - C:\WINDOWS\system32\551.dll - Player 动态链接库 - 576cadaa9c201b5f05aec6e85cd37c31

=======================================

O41 - a320raid - Adaptec HostRAID for Ultra320 SCSI - C:\WINDOWS\system32\drivers\a320raid.sys - (not running) - Adaptec HostRAID for Ultra320 SCSI - Adaptec, Inc. - 0532434d53314ee8858b7bfdbe761837
O41 - AAC - Adaptec RAID Miniport Driver - C:\WINDOWS\system32\drivers\aac.sys - (not running) - Adaptec RAID Miniport Driver - Adaptec, Inc. - f9ee3c7a185d121b145164cb10c057a7
O41 - aar1210 - Adaptec HostRAID for Serial ATA - C:\WINDOWS\system32\drivers\aar1210.sys - (not running) - Adaptec HostRAID for Serial ATA - Adaptec, Inc. - 316945ebc9398f222a6fff3d04d41fcb
O41 - adpu320 - Adaptec Win2K/XP/Server2003 Ultra320 SCSI Driver - C:\WINDOWS\system32\drivers\adpu320.sys - (not running) - Adaptec Win2K/XP/Server2003 Ultra320 SCSI Driver - Adaptec, Inc. - c234c8595918e4403016fc7e87abf153
O41 - aec6210 - aec6210 - C:\WINDOWS\system32\drivers\AEC6210.sys - (not running) -  - ACARD Technology Corp. - 38e6c035e89fb8b079301e71b2523f3d
O41 - aec6260 - ID=0006, 0007 - C:\WINDOWS\system32\drivers\AEC6260.sys - (not running) - ID=0006, 0007 - ACARD Technology Corp. - db227bd0ba1f29bb38950f8fd97caa35
O41 - aec6280 - AEC6280 Miniport Driver - C:\WINDOWS\system32\drivers\AEC6280.SYS - (not running) - AEC6280 Miniport Driver - ACARD Technology Corp. - 71c3ab81b22c151a2e2ba97ec53430ca
O41 - AEC6290 - AEC6280 Miniport Driver - C:\WINDOWS\system32\drivers\AEC6290.SYS - (not running) - AEC6280 Miniport Driver - ACARD Technology Corp. - 71c3ab81b22c151a2e2ba97ec53430ca
O41 - AEC67160 - AEC67160 PCI Ultra3 LVD/SE Adapter Driver - C:\WINDOWS\system32\drivers\AEC67160.SYS - (not running) - AEC67160 PCI Ultra3 LVD/SE Adapter Driver - ACARD Technology Corp. - f2b276e8f4057dd1ba2bd40ecaf1ac57
O41 - AEC671X - AEC671X PCI Ultra/W SCSI3 Adapter Driver - C:\WINDOWS\system32\drivers\AEC671X.SYS - (not running) - AEC671X PCI Ultra/W SCSI3 Adapter Driver - ACARD Technology Corp. - 9493824293585203212d0157cb2430a7
O41 - AEC6880 - AEC6880/90 PCI Ultra ATA133 RAID Adapter Driver - C:\WINDOWS\system32\drivers\AEC6880.SYS - (not running) - AEC6880/90 PCI Ultra ATA133 RAID Adapter Driver - ACARD Technology Corp. - 415f252cee34bbf839acbcadb2bc85ce
O41 - AEC6890 - AEC6880/90 PCI Ultra ATA133 RAID Adapter Driver - C:\WINDOWS\system32\drivers\AEC6890.SYS - (not running) - AEC6880/90 PCI Ultra ATA133 RAID Adapter Driver - ACARD Technology Corp. - 415f252cee34bbf839acbcadb2bc85ce
O41 - aec68x5 - AEC6885/95/96 PCI ATA133 4 Channel RAID Adapter Driver - C:\WINDOWS\system32\drivers\aec68X5.sys - (not running) - AEC6885/95/96 PCI ATA133 4 Channel RAID Adapter Driver - ACARD Technology Corp. - 6275261ebb499358ff5c5cf901f7ad6c
O41 - AmdK8 - Processor Device Driver - C:\WINDOWS\system32\drivers\amdk8.sys - (not running) - Processor Device Driver - Microsoft Corporation - f3db0078e05f9480abc58ad94cb03ce4
O41 - arc - Adaptec RAID Storport Driver - C:\WINDOWS\system32\drivers\arc.sys - (not running) - Adaptec RAID Storport Driver - Adaptec, Inc. - 03db2261f2abbc70780fc06850cdd4bd
O41 - elxstor - Storport Miniport Driver for LightPulse HBAs - C:\WINDOWS\system32\drivers\elxstor.sys - (not running) - Storport Miniport Driver for LightPulse HBAs - Emulex - 83054fc939537446d35db871c20da128
O41 - FASTSX - Promise FastTRAK SX4/SX4000 Driver for WindowsXP - C:\WINDOWS\system32\drivers\fastsx.sys - (not running) - Promise FastTRAK SX4/SX4000 Driver for WindowsXP - Promise Technology, Inc. - 21ab10bc1c78a68cdf0cbd304dbfb7fa
O41 - fasttrak - Promise FastTrak Series Driver for WinXP - C:\WINDOWS\system32\drivers\fasttrak.sys - (not running) - Promise FastTrak Series Driver for WinXP - Promise Technology, Inc. - eb1c078d99cc081c1d2ae3a19e2284cc
O41 - fasttx2k - Promise Driver for Windows XP - C:\WINDOWS\system32\drivers\fasttx2k.sys - (not running) - Promise Driver for Windows XP - Promise Technology, Inc. - 5d95724d3c3923449c02be1106657bcd
O41 - fasttx2k2 - Promise FastTrak Series Driver for WindowsXP - C:\WINDOWS\system32\drivers\fasttx2k2.sys - (not running) - Promise FastTrak Series Driver for WindowsXP - Promise Technology, Inc. - c127946de07bbb00f69f78923577dae4
O41 - GMSIPCI - GMSIPCI - G:\INSTALL\GMSIPCI.SYS - (not running) -  -  -
O41 - HDAudBus - High Definition Audio Bus Driver v1.0a - C:\WINDOWS\system32\drivers\hdaudbus.sys - (running) - High Definition Audio Bus Driver v1.0a - Windows (R) Server 2003 DDK provider - 3fcc124b6e08ee0e9351f717dd136939
O41 - HpCISSs - Smart Array 5x and 6x Controllers Storport Driver - C:\WINDOWS\system32\drivers\hpcisss.sys - (not running) - Smart Array 5x and 6x Controllers Storport Driver - Hewlett-Packard Company - 1712369d00c88b8c8205790aa4b225d0
O41 - Hpt366 - ATAPI IDE Miniport Driver - C:\WINDOWS\system32\drivers\hpt366.sys - (not running) - ATAPI IDE Miniport Driver - Microsoft Corporation - 4e4c5dde3eb4e9392c9659818790ed6c
O41 - HPT371 - HPT3xx Miniport Driver - C:\WINDOWS\system32\drivers\hpt371.sys - (not running) - HPT3xx Miniport Driver - HighPoint Technologies, Inc. - cac96d5be76a3d20c41759b12167c09b
O41 - hpt374 - HPT374 Miniport Driver - C:\WINDOWS\system32\drivers\hpt374.sys - (not running) - HPT374 Miniport Driver - HighPoint Technologies, Inc. - ccee236589335d118e22d0fe400233a6
O41 - hpt3xx - HPT3xx Miniport Driver - C:\WINDOWS\system32\drivers\hpt3xx.sys - (not running) - HPT3xx Miniport Driver - HighPoint Technologies, Inc. - 9f2dfe54317b1cd38143686935a278d9
O41 - hptmv - hptmv Miniport Driver - C:\WINDOWS\system32\drivers\hptmv.sys - (not running) - hptmv Miniport Driver - HighPoint Technologies, Inc. - 4f92f14095d52ca870039b192a3319b0
O41 - hptpro - Hptpro - C:\WINDOWS\system32\drivers\hptpro.sys - (not running) - Hptpro - HighPoint Technologies, Inc. - 977716f8a6edda986fdb41de52bdb689
O41 - iaStor - Intel Application Accelerator driver - C:\WINDOWS\system32\drivers\iastor.sys - (not running) - Intel Application Accelerator driver - Intel Corporation - bdce6b54e1d7d8399175a83a02274b7a
O41 - iirsp - Intel/ICP Raid Storport Driver - C:\WINDOWS\system32\drivers\iirsp.sys - (not running) - Intel/ICP Raid Storport Driver - Intel Corp./ICP vortex GmbH - c1e08b2845995ac1cbcde37ac2c55b68
O41 - iteraid - ITE IT8212 ATA RAID SCSI miniport - C:\WINDOWS\system32\drivers\iteraid.sys - (not running) - ITE IT8212 ATA RAID SCSI miniport - Integrated Technology Express, Inc. - eebd120b0eeb78c3374ddc72fa55e789
O41 - LSI_FC - LSI Logic Fusion-MPT FC Driver (StorPort) - C:\WINDOWS\system32\drivers\lsi_fc.sys - (not running) - LSI Logic Fusion-MPT FC Driver (StorPort) - LSI Logic - 42f8e6058cddabfa5bbd1afb9c552060
O41 - LSI_SAS - LSI Logic Fusion-MPT SAS Driver (StorPort) - C:\WINDOWS\system32\drivers\lsi_sas.sys - (not running) - LSI Logic Fusion-MPT SAS Driver (StorPort) - LSI Logic - 73c195bcee1530e6107339f1e427dded
O41 - LSI_SCSI - LSI Logic Fusion-MPT SCSI Driver (StorPort) - C:\WINDOWS\system32\drivers\lsi_scsi.sys - (not running) - LSI Logic Fusion-MPT SCSI Driver (StorPort) - LSI Logic - 72b9219213c6935fd9c4ba9e2ec7e207
O41 - m5228 - M5228 ATA RAID Controller Driver - C:\WINDOWS\system32\drivers\m5228.sys - (not running) - M5228 ATA RAID Controller Driver - ALi Corporation. - 4bc8aa133cdb516392ac76d9948138bc
O41 - m5281 - M5281 SATA RAID Controller Driver - C:\WINDOWS\system32\drivers\m5281.sys - (not running) - M5281 SATA RAID Controller Driver - ALi Corporation - 3bb7e4f0d880c57b75ab2197f6e21897

O41 - megasas - MEGASAS RAID Controller Driver for Windows for x86 - C:\WINDOWS\system32\drivers\megasas.sys - (not running) - MEGASAS RAID Controller Driver for Windows for x86 - LSI Logic Corporation - 53e3718e5aaae794f412543f819f8344
O41 - mraid2k - MEGARAID SCSI Controller Driver for Windows 2000 PAE - C:\WINDOWS\system32\drivers\MRAID2K.SYS - (not running) - MEGARAID SCSI Controller Driver for Windows 2000 PAE - American Megatrends, Inc. - a7bb113a38b04c0296bfa76b41d92f95
O41 - nfrd960 - IBM ServeRAID Controller Driver - C:\WINDOWS\system32\drivers\nfrd960.sys - (not running) - IBM ServeRAID Controller Driver - IBM Corporation - d5314d4a43cdcf2072aa46a3be39c764
O41 - npkcrypt - npkcrypt - UNC\W01\1号机d盘\Program Files\Tencent\qq\npkcrypt.sys - (not running) -  -  -
O41 - npkycryp - npkycryp - UNC\W01\1号机d盘\Program Files\Tencent\qq\npkycryp.sys - (not running) -  -  -
O41 - nvraid - NVIDIA? nForce(TM) RAID Driver - C:\WINDOWS\system32\drivers\nvraid.sys - (not running) - NVIDIA? nForce(TM) RAID Driver - NVIDIA Corporation - 30dd670c6ffa1e0ef51955c08a7fe5bf
O41 - oddbse34 - Kernel - C:\WINDOWS\system32\drivers\oddbse34.sys - (not running) - Kernel - Microsoft Corporation - 4b2fb17837231f62b9f717f831c04217
O41 - PNP649R - IDE RAID miniport driver - C:\WINDOWS\system32\drivers\PnP649r.sys - (not running) - IDE RAID miniport driver - CMD Technology, Inc. - 5a5a6a1003eecd15df2f383972e86188
O41 - Pnp680 - DMA capable ATA miniport driver - C:\WINDOWS\system32\drivers\Pnp680.sys - (not running) - DMA capable ATA miniport driver - Silicon Image, Inc. - 023657a82e76ad98f3fafbd1ec425a71
O41 - Pnp680r - DMA capable ATA RAID miniport driver  - C:\WINDOWS\system32\drivers\PnP680r.sys - (not running) - DMA capable ATA RAID miniport driver  - Silicon Image, Inc - a1d7a9214b71ebbb6f31cb84aac15525
O41 - ql2300 - QLogic Fibre Channel Stor Miniport Driver - C:\WINDOWS\system32\drivers\ql2300.sys - (not running) - QLogic Fibre Channel Stor Miniport Driver - QLogic Corporation - 8d21bae29162b1a9ea17e895e9f825eb
O41 - RAIDSRC - Intel(r)/ICP Miniport Driver - C:\WINDOWS\system32\drivers\raidsrc.sys - (not running) - Intel(r)/ICP Miniport Driver - Intel/ICP - 4ba4a4ac184ed0cf15faa62e2375883f
O41 - S150SX8 - Promise SATAII150 SX8 Driver for WindowsXP - C:\WINDOWS\system32\drivers\S150sx8.sys - (not running) - Promise SATAII150 SX8 Driver for WindowsXP - Promise Technology, Inc. - 13d1e68b006ae72276079f5fcbe5a471
O41 - SI3112 - Serial ATA miniport driver - C:\WINDOWS\system32\drivers\Si3112.sys - (not running) - Serial ATA miniport driver - Silicon Image, Inc. - 77f5cf403657f5086df7f4ed1f497cbb
O41 - SI3112r - Serial ATA RAID Miniport Driver - C:\WINDOWS\system32\drivers\Si3112r.sys - (not running) - Serial ATA RAID Miniport Driver - Silicon Image, Inc - d89dde61753a3b5d64e15a1a925588cc
O41 - SI3114 - Serial ATA miniport driver - C:\WINDOWS\system32\drivers\Si3114.sys - (not running) - Serial ATA miniport driver - Silicon Image, Inc. - 9c67403714df81c8bdf177ce440c9d84
O41 - SI3114r - SATARAID Miniport Driver - C:\WINDOWS\system32\drivers\Si3114r.sys - (not running) - SATARAID Miniport Driver - Silicon Image, Inc - 53ee85fa0b48eb64031a190adf23c8d8
O41 - SI3124 - Serial ATA miniport driver - C:\WINDOWS\system32\drivers\Si3124.sys - (not running) - Serial ATA miniport driver - Silicon Image, Inc. - da09038c6d12cf69031b515741250f7b
O41 - SI3124r - SATARAID miniport driver (PRE-RELEASE) - C:\WINDOWS\system32\drivers\Si3124r.sys - (not running) - SATARAID miniport driver (PRE-RELEASE) - Silicon Image, Inc - 0c71855057883e63ca2c19736cbab018
O41 - SiFilter - Windows Accelerator Driver - C:\WINDOWS\system32\drivers\SiWinAcc.sys - (not running) - Windows Accelerator Driver - Silicon Image, Inc. - 1582e88c6f340627247b1ecd00fa84fe
O41 - SISIDE - SiS PCI Mini IDE Driver - C:\WINDOWS\system32\drivers\siside.sys - (not running) - SiS PCI Mini IDE Driver - Silicon Integrated Systems Corp. - b4485881bd8aed9b157a2e6cf43c2d51
O41 - SiSRaid - SiS RAID Miniport Driver - C:\WINDOWS\system32\drivers\sisraid.sys - (not running) - SiS RAID Miniport Driver - Silicon Integrated Systems - 4c597e4de6edf6453990059ba0eac7d0
O41 - SiSRaid1 - SiS RAID Miniport Driver - C:\WINDOWS\system32\drivers\sisraid1.sys - (not running) - SiS RAID Miniport Driver - Silicon Integrated Systems - 52192d1a30ae56a203c047213b0f596b
O41 - SISRAIDS - SiS RAID Miniport Driver - C:\WINDOWS\system32\drivers\SISRAIDS.SYS - (not running) - SiS RAID Miniport Driver - Silicon Integrated Systems Corp - 46cecd8f57e63bdb9d6c9f130be2d97c
O41 - sptrak - Promise SuperTrak Family Driver for WindowsNT - C:\WINDOWS\system32\drivers\Sptrak.sys - (not running) - Promise SuperTrak Family Driver for WindowsNT - Promise Technology, Inc. - b04bdc24f80ecb319f64189194399989
O41 - SYMMPI - LSI Logic Fusion-MPT MiniPort Driver (ScsiPort) - C:\WINDOWS\system32\drivers\symmpi.sys - (not running) - LSI Logic Fusion-MPT MiniPort Driver (ScsiPort) - LSI Logic - 3adffb39782474652f4ea2cf1345b340
O41 - UlSata - Promise Ultra/Sata Series Driver for WinXP - C:\WINDOWS\system32\drivers\ulsata.sys - (not running) - Promise Ultra/Sata Series Driver for WinXP - Promise Technology, Inc. - 2c2777217a706f62a9d225256ceaf30a
O41 - ULSATAS - Promise SATAII150 Series Driver for Win2003 - C:\WINDOWS\system32\drivers\ulsatas.sys - (not running) - Promise SATAII150 Series Driver for Win2003 - Promise Technology, Inc. - 0c5583d3bb02e78e639eac234e97d515
O41 - viamraid - VIA RAID DRIVER FOR WIN 2000/XP/2003IA32 - C:\WINDOWS\system32\drivers\viamraid.sys - (not running) - VIA RAID DRIVER FOR WIN 2000/XP/2003IA32 - VIA Technologies inc,.ltd - f199939205dccc7836ae5ab8b5dd5e83
O41 - viapdsk - VIA VT4149 PATA Driver - C:\WINDOWS\system32\drivers\viapdsk.sys - (not running) - VIA VT4149 PATA Driver - VIA Technologies, Inc. - f314359357b6960eb727620470ffc9cf
O41 - viaraid - VT6410 RAID DRIVER FOR WINXP - C:\WINDOWS\system32\drivers\viaraid.sys - (not running) - VT6410 RAID DRIVER FOR WINXP - VIA Technologies inc,.ltd - 29d02cee410d4ed80014bbf0fc98bd2d
O41 - viasraid - VIA SATA RAID DRIVER FOR WINXP - C:\WINDOWS\system32\drivers\viasraid.sys - (not running) - VIA SATA RAID DRIVER FOR WINXP - VIA Technologies inc,.ltd - ebe101c01d80a42868f57b327be1b564
O41 - vmscsi - VMware SCSI Controller - C:\WINDOWS\system32\drivers\vmscsi.sys - (not running) - VMware SCSI Controller - VMware, Inc. - cd8a1f04836111dc0e6c0cd904b3c660

=======================================

换SRE日志

虽然不太会看这种，但是浏览后也能看出病毒，同意6楼