在进程中发现两个SVCHOST.EXE在运行，都无法删除。一个是在C：WINNT/STSTEM32下，在打开有的程序时会出现一个关于它的DOS界面，一个是在C：WINNT/STSTEM32/DLLCACHE下，前者在安全模式下也无法删除，后者则可以，请高手帮帮忙看看是不是有问题。谢了！！！一楼为日志。

Logfile of HijackThis v1.99.1
Scan saved at 18:20:08, on 2006/09/29
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINNT\system32\internat.exe
C:\WINNT\TEMP\MYB1BF.EXE
C:\WINNT\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINNT\msagent\AgentSvr.exe
F:\新建文件夹\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [wdfmgr32] C:\WINNT\system32\wdfmgr32.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [Super Rabbit IEPro] C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O15 - Trusted IP range: http://145.28.16.48
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - http://145.28.16.90/officescan/console/ClientInstall/WinNTChk.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupINICtrl Class) - http://145.28.16.90/officescan/console/ClientInstall/setupini.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://145.28.16.90/officescan/console/ClientInstall/setup.cab
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - http://145.28.16.90/officescan/console/html/AtxEnc.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://145.28.16.90/officescan/console/ClientInstall/RemoveCtrl.cab
O16 - DPF: {74444F3F-D1AF-41FE-80A5-3CEE414CB9F9} (frmLoadLocalTable Control) - http://145.28.16.48:7890/archtax/LoadLocalTable.ocx
O16 - DPF: {84B248CC-7729-404F-830C-63413A8332A9} (SetupOcx2000Impl Control) - http://145.28.16.40/ocxbin/SetupOcx2000.ocx
O16 - DPF: {8E293669-B9DA-4C07-BBC4-F8D68B005368} (SetupOcxImpl Control) - http://145.28.16.48:7890/ocxbin/SetupOcx.ocx
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0D28F67-F7AD-40B9-883B-3AC164CE2866}: NameServer = 192.168.0.1
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: OfficeScanNT 实时扫描 (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT 个人防火墙 (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - c:\oracle\BIN\ONRSD.EXE
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: OfficeScanNT 侦听程序 (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

怎么没人帮看看看？各位大虾！行行好！帮看看吧？给大家作揖了~~~~~~~

谢谢大家！之所以认为有问题是因为在打开一些程序的时候会跳出C；WINNT/SYSTEM32/SVCHOST.EXE下的DOS界面，而且有时打开IE的时候，会接连打开几个界面，杀毒软件就会发现一个病毒，紧接着硬盘老是连续发出吱~~~~~~~~的声音，过了一段时间后，杀毒软件扫出10多和病毒后，就死机了，在重启后，就进不了，不断进入重启状态，没法进如WINDOWS界面，只好重装，开始重装几次，但只要一上IE，过不了多久就又完了！不上就没事，这次我把它断线后，删除IE临时文件夹后，好象就没什么大问题了，但开机的时候还是会有DOS界面出现，有点不放心，所以请教大家一下，对了SVCHOST.EXE的文件的图标不是科南的。

感谢楼上的帮忙！非常感谢！！！经查：wdfmgr32.exe为未知进程，已经将其删除，效果有待观察，如有知道wdfmgr32.exe是干吗用的，请在这里告知，先谢了。

找到wdfmgr32.exe后，发现边上有一个文本文件wdfmgr32.LOG，打开看了看，只有OK，其他什么都没有，不知道会不会有问题？