一位网友的电脑开机进入桌面后，提示svchost.exe、D401AB94.EXE等出错。使用一键还原恢复C盘，无效。请偶帮忙检修。
下载 pe_xscan 扫描 log，并分析，发现如下可疑项：
/=== pe_xscan 07-08-30 by Purple Endurer 2005-11-21 20:7:50 Windows XP Service Pack 2(5.1.2600) 管理员用户组 [System Process] * 0 C:/WINDOWS/system32/gdjzi32.dll | 2005-11-21 19:42:52 C:/WINDOWS/system32/gdwdi32.dll | 2005-11-21 19:40:52 C:/WINDOWS/system32/gdwli32.dll | 2005-11-21 19:41:44 C:/WINDOWS/system32/gdzxi32.dll | 2005-11-21 19:41:18 C:/WINDOWS/system32/gdmsi32.dll | 2005-11-21 19:41:16 C:/WINDOWS/system32/gdzhtui32.dll | 2005-11-21 19:40:42 C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys | 2000-10-22 0:30:14 C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys | 2000-10-22 0:29:56 C:/WINDOWS/system32/gwhqiotagms.dll | 2000-10-22 0:8:4 C:/Program Files/Internet Explorer/IEXPLORE32.Dat | 2005-11-21 19:46:34 C:/Program Files/Internet Explorer/IEXPLORE32.Sys | 2005-11-21 19:46:56 C:/WINDOWS/system32/zhjtrx.dll | 2004-8-17 12:0:0 C:/WINDOWS/system32/winlogon.exe * 500 | 2004-8-17 12:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Windows NT Logon Application | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | winlogon | WINLOGON.EXE C:/WINDOWS/system32/winlib .dll C:/WINDOWS/system32/videodevice.dll | 2005-11-21 19:42:50 C:/WINDOWS/system32/services.exe * 544 | 2004-8-17 12:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Services and Controller app | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | services.exe | services.exe C:/WINDOWS/system32/LYMANGR.DLL | 2005-11-21 20:2:56 C:/WINDOWS/System32/svchost.exe * 824 | 2004-8-17 12:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe c:/windows/inf/wnlyuhkh.dll | 2000-10-22 0:21:30 C:/WINDOWS/system32/videodevice.dll | 2005-11-21 19:42:50 C:/WINDOWS/Explorer.exe * 1212 | 2004-8-17 12:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Windows Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | explorer | EXPLORER.EXE C:/Program Files/Internet Explorer/PLUGINS/NewTemp.dll | 2000-10-22 0:29:34 C:/WINDOWS/system32/gwhqiotagms.dll | 2000-10-22 0:8:4 C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys | 2000-10-22 0:29:56 C:/WINDOWS/system32/zhjtrx.dll | 2004-8-17 12:0:0 C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys | 2000-10-22 0:30:14 C:/Program Files/Internet Explorer/IEXPLORE32.Sys | 2005-11-21 19:46:56 C:/Program Files/Internet Explorer/IEXPLORE32.Dat | 2005-11-21 19:46:34 C:/Program Files/Internet Explorer/IEXPLORE32.win | 2005-11-21 19:46:46 C:/WINDOWS/system32/iczqb.dll C:/WINDOWS/system32/hhhqcz46.dll | 2006-7-5 18:56:0 C:/WINDOWS/system32/vcshow.dll | 2005-11-21 19:48:4 | | 1.0.0.0 | | | 1.1.1.435 | | | | C:/WINDOWS/system32/jfwjoo56.dll | 2007-9-29 11:30:10 | | 1, 1, 1, 1036 | C | | 1, 1, 1, 1051 | | | | C:/WINDOWS/system32/videodevice.dll | 2005-11-21 19:42:50 C:/WINDOWS/system32/gdzhtui32.dll | 2005-11-21 19:40:42 C:/WINDOWS/system32/gdmsi32.dll | 2005-11-21 19:41:16 C:/WINDOWS/system32/gdwli32.dll | 2005-11-21 19:41:44 C:/WINDOWS/system32/gdzxi32.dll | 2005-11-21 19:41:18 C:/WINDOWS/system32/gdwdi32.dll | 2005-11-21 19:40:52 C:/WINDOWS/system32/gdjzi32.dll | 2005-11-21 19:42:52 c:/docume~1/admini~1/locals~1/temp/wncktngc.dll | 2005-11-21 20:4:26 C:/WINDOWS/system32/rundll32.exe * 1504 | 2004-8-17 12:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Run a DLL as an App | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | rundll | RUNDLL.EXE C:/WINDOWS/system32/winsys16_071021.dll | 2000-10-22 0:17:20 C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys | 2000-10-22 0:30:14 C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys | 2000-10-22 0:29:56 C:/WINDOWS/system32/gwhqiotagms.dll | 2000-10-22 0:8:4 C:/Program Files/Internet Explorer/IEXPLORE32.Dat | 2005-11-21 19:46:34 C:/Program Files/Internet Explorer/IEXPLORE32.Sys | 2005-11-21 19:46:56 C:/WINDOWS/system32/zhjtrx.dll | 2004-8-17 12:0:0 C:/WINDOWS/system32/ctfmon.exe * 1820 | 2004-8-17 12:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | CTF Loader | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | CTFMON | CTFMON.EXE C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys | 2000-10-22 0:30:14 C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys | 2000-10-22 0:29:56 C:/WINDOWS/system32/gwhqiotagms.dll | 2000-10-22 0:8:4 C:/Program Files/Internet Explorer/IEXPLORE32.Dat | 2005-11-21 19:46:34 C:/Program Files/Internet Explorer/IEXPLORE32.Sys | 2005-11-21 19:46:56 C:/WINDOWS/system32/zhjtrx.dll | 2004-8-17 12:0:0 C:/WINDOWS/system32/gdjzi32.dll | 2005-11-21 19:42:52 C:/WINDOWS/system32/gdwdi32.dll | 2005-11-21 19:40:52 C:/WINDOWS/system32/gdwli32.dll | 2005-11-21 19:41:44 C:/WINDOWS/system32/gdzxi32.dll | 2005-11-21 19:41:18 C:/WINDOWS/system32/gdmsi32.dll | 2005-11-21 19:41:16 C:/WINDOWS/system32/gdzhtui32.dll | 2005-11-21 19:40:42 C:/program files/internet explorer/iexplore.exe * 1924 | 2004-8-17 20:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Internet Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | iexplore | IEXPLORE.EXE C:/WINDOWS/system32/winsys32_071021.dll | 2005-11-21 20:3:32 C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys | 2000-10-22 0:30:14 C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys | 2000-10-22 0:29:56 C:/WINDOWS/system32/gwhqiotagms.dll | 2000-10-22 0:8:4 C:/WINDOWS/system32/videodevice.dll | 2005-11-21 19:42:50 C:/WINDOWS/system32/gdjzi32.dll | 2005-11-21 19:42:52 C:/WINDOWS/system32/gdwdi32.dll | 2005-11-21 19:40:52 C:/WINDOWS/system32/gdwli32.dll | 2005-11-21 19:41:44 C:/WINDOWS/system32/gdzxi32.dll | 2005-11-21 19:41:18 C:/WINDOWS/system32/gdmsi32.dll | 2005-11-21 19:41:16 C:/WINDOWS/system32/gdzhtui32.dll | 2005-11-21 19:40:42 C:/WINDOWS/system32/wuauclt.exe * 2856 | 2007-7-30 19:19:16 | Microsoft? Windows? Operating System | 7.0.6000.381 | Windows Update Automatic Updates | ? Microsoft Corporation. All rights reserved. | 7.0.6000.381 (winmain(wmbla).070730-1740) | Microsoft Corporation| ? | wuauclt.exe | wuauclt.exe C:/WINDOWS/system32/gdjzi32.dll | 2005-11-21 19:42:52 C:/WINDOWS/system32/gdwdi32.dll | 2005-11-21 19:40:52 C:/WINDOWS/system32/gdwli32.dll | 2005-11-21 19:41:44 C:/WINDOWS/system32/gdzxi32.dll | 2005-11-21 19:41:18 C:/WINDOWS/system32/gdmsi32.dll | 2005-11-21 19:41:16 C:/WINDOWS/system32/gdzhtui32.dll | 2005-11-21 19:40:42 C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys | 2000-10-22 0:30:14 C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys | 2000-10-22 0:29:56 C:/WINDOWS/system32/gwhqiotagms.dll | 2000-10-22 0:8:4 C:/Program Files/Internet Explorer/IEXPLORE32.Dat | 2005-11-21 19:46:34 C:/Program Files/Internet Explorer/IEXPLORE32.Sys | 2005-11-21 19:46:56 C:/WINDOWS/system32/zhjtrx.dll | 2004-8-17 12:0:0 C:/WINDOWS/system32/inf/svchost.exe * 3336 | 2004-8-17 12:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Run a DLL as an App | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | rundll | RUNDLL.EXE C:/WINDOWS/system32/lwisys16_071113.dll | 2005-11-21 20:5:40 C:/WINDOWS/system32/gdjzi32.dll | 2005-11-21 19:42:52 C:/WINDOWS/system32/gdwdi32.dll | 2005-11-21 19:40:52 C:/WINDOWS/system32/gdwli32.dll | 2005-11-21 19:41:44 C:/WINDOWS/system32/gdzxi32.dll | 2005-11-21 19:41:18 C:/WINDOWS/system32/gdmsi32.dll | 2005-11-21 19:41:16 C:/WINDOWS/system32/gdzhtui32.dll | 2005-11-21 19:40:42 C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys | 2000-10-22 0:30:14 C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys | 2000-10-22 0:29:56 C:/WINDOWS/system32/gwhqiotagms.dll | 2000-10-22 0:8:4 C:/program files/internet explorer/iexplore.exe * 3748 | 2004-8-17 20:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Internet Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | iexplore | IEXPLORE.EXE C:/WINDOWS/system32/mwisys32_071113.dll | 2005-11-21 20:5:52 C:/WINDOWS/system32/gdjzi32.dll | 2005-11-21 19:42:52 C:/WINDOWS/system32/gdwdi32.dll | 2005-11-21 19:40:52 C:/WINDOWS/system32/gdwli32.dll | 2005-11-21 19:41:44 C:/WINDOWS/system32/gdzxi32.dll | 2005-11-21 19:41:18 C:/WINDOWS/system32/gdmsi32.dll | 2005-11-21 19:41:16 C:/WINDOWS/system32/gdzhtui32.dll | 2005-11-21 19:40:42 C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys | 2000-10-22 0:30:14 C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys | 2000-10-22 0:29:56 C:/WINDOWS/system32/gwhqiotagms.dll | 2000-10-22 0:8:4 C:/WINDOWS/system32/videodevice.dll | 2005-11-21 19:42:50 C:/Program Files/Internet Explorer/PLUGINS/NewTemp.dll | 2000-10-22 0:29:34 C:/WINDOWS/system32/zhjtrx.dll | 2004-8-17 12:0:0 C:/Program Files/Internet Explorer/IEXPLORE32.Sys | 2005-11-21 19:46:56 C:/Program Files/Internet Explorer/IEXPLORE32.Dat | 2005-11-21 19:46:34 C:/Program Files/Internet Explorer/IEXPLORE32.win | 2005-11-21 19:46:46 C:/WINDOWS/system32/0734/svchost.exe * 3632 | 2000-10-22 0:21:30 C:/WINDOWS/system32/gdjzi32.dll | 2005-11-21 19:42:52 C:/WINDOWS/system32/gdwdi32.dll | 2005-11-21 19:40:52 C:/WINDOWS/system32/gdwli32.dll | 2005-11-21 19:41:44 C:/WINDOWS/system32/gdzxi32.dll | 2005-11-21 19:41:18 C:/WINDOWS/system32/gdmsi32.dll | 2005-11-21 19:41:16 C:/WINDOWS/system32/gdzhtui32.dll | 2005-11-21 19:40:42 C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys | 2000-10-22 0:30:14 C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys | 2000-10-22 0:29:56 C:/WINDOWS/system32/gwhqiotagms.dll | 2000-10-22 0:8:4 C:/WINDOWS/system32/videodevice.dll | 2005-11-21 19:42:50 C:/Program Files/Internet Explorer/IEXPLORE32.Dat | 2005-11-21 19:46:34 C:/Program Files/Internet Explorer/IEXPLORE32.Sys | 2005-11-21 19:46:56 C:/WINDOWS/system32/zhjtrx.dll | 2004-8-17 12:0:0 F2 - RShell = <explorer.exe vchelp.exe> O2 - BHO CAdLogic Object - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:/Program Files/Common Files/CPUSH/cpush0.dll O2 - BHO IEAux Class - {7605CC7C-00FD-4A5F-BAFD-828342DE6279} - C:/PROGRA~1/OCINS/ieaux.dll O2 - BHO WZCNBHO Class - {D500885E-E400-41CA-804B-CD6373A7EEF2} - C:/Program Files/WZCN/cn_ie_wzcn.dll O4 - HKLM/../Run: [WinSysW] C:/WINDOWS/swchost.exe O4 - HKLM/../Run: [WinSysM] C:/WINDOWS/IGM.exe O4 - HKLM/../Run: [WinForm] C:/WINDOWS/WinForm.exe O4 - HKLM/../Run: [upxdnd] C:/WINDOWS/upxdnd.exe O4 - HKLM/../Run: [switch] c:/windows/system32/壁纸自动换.exe O4 - HKLM/../Run: [svchost] C:/WINDOWS/svchost.exe O4 - HKLM/../Run: [SmCtrlDrv] D;]XJOEPXT]tztufn43]Svoemm43/fyf!D;]XJOEPXT]tztufn43]deoqsi/emm!Tubsu O4 - HKLM/../Run: [QuickNews] "C:/Windows/system32/wbem/KRYEMTZGOVBIQWC.EXE" O4 - HKLM/../Run: [NVDispDrv] C:/WINDOWS/lyngig.exe O4 - HKLM/../Run: [MsIMMs32] C:/WINDOWS/MsIMMs32.exe O4 - HKLM/../Run: [Kvsc3] C:/WINDOWS/Kvsc3.exe O4 - HKLM/../Run: [KVP] C:/WINDOWS/system32/drivers/svchost.exe O4 - HKLM/../Run: [jfwjoo56] %systemroot%/system32/Rundll32.exe "%systemroot%/system32/jfwjoo56.dll",DllCanUnloadNow O4 - HKLM/../Run: [GenProtect] C:/WINDOWS/GenProtect.exE O4 - HKLM/../Run: [cmdbcs] C:/WINDOWS/cmdbcs.exe O4 - HKLM/../Run: [AVPSrv] C:/WINDOWS/AVPSrv.exe O4 - HKLM/../Policies/Explorer/Run: [MSDEG32] LYLoader.exe O4 - HKLM/../Policies/Explorer/Run: [MSDWG32] LYLoadbr.exe O4 - HKLM/../Policies/Explorer/Run: [MSDCG32 ] LYLeador.exe O4 - HKLM/../Policies/Explorer/Run: [MSDOG32] LYLoador.exe O4 - HKLM/../Policies/Explorer/Run: [MSDSG32] LYLoadar.exe O4 - HKLM/../Policies/Explorer/Run: [MSDMG32] LYLoadmr.exe O4 - HKLM/../Policies/Explorer/Run: [MSDHG32] LYLoadhr.exe O4 - HKLM/../Policies/Explorer/Run: [MSDQG32] LYLoadqr.exe O4 - HKLM/../Policies/Explorer/Run: [Userinit] rundll32.exe C:/WINDOWS/system32/winsys16_071021.dll start C:/autorun.inf /----- [autorun] open=PegeFile.pif shellexecute=PegeFile.pif shell/Auto/command=PegeFile.pif shell=Auto -----/ D:/autorun.inf /----- [autorun] open=PegeFile.pif shellexecute=PegeFile.pif shell/Auto/command=PegeFile.pif shell=Auto -----/ E:/autorun.inf /----- [autorun] open=PegeFile.pif shellexecute=PegeFile.pif shell/Auto/command=PegeFile.pif shell=Auto -----/ F:/autorun.inf /----- [autorun] open=PegeFile.pif shellexecute=PegeFile.pif shell/Auto/command=PegeFile.pif shell=Auto -----/ O8 - IE右键菜单附加项 : &访问通用网址 - C:/Program Files/OCINS/cnrbtn.html O9 - IE工具栏扩展按钮HKLM：中文上网 - {B012491E-8FA4-4851-AA9B-22E33784FBAD} - C:/Program Files/OCINS/config.exe O9 - IE工具菜单扩展项HKLM：中文上网 - {B012491E-8FA4-4851-AA9B-22E33784FBAD} - C:/Program Files/OCINS/config.exe O10 - 未知LSP: c:/windows/system32/videodevice.dll O23 - 服务: 100133 (100133) - System32/drivers/100133.sys(禁用) O23 - 服务: 219829DA (219829DA) - C:/WINDOWS/system32/D401AB94.EXE -g | 2005-11-21 19:47:44| ?| ?| ?| ?| ? | Microsoft Corporation| ?| ?| ?(自动) O23 - 服务: cnprov (cnprov) - system32/drivers/cnprov.sys | 中文上网官方版 | 2, 6, 0, 0 | 国际化域名辅助模块 | Copyright (c) . All rights reserved. | 2.6.0.0 | 中国互联网络信息中心(CNNIC)| ? | cnprov.sys | cnprov.sys(引导) O23 - 服务: CnsMinKP (CnsMinKP) - system32/drivers/CnsMinKP.sys | KMD | 2.0.5.1001 | KMD | Copyright (c) 3721 Corporation. | 2.0.5.1001 | Copyright (C) 3721 Corporation.| ? | CnsMinKP.sys | CnsMinKP.sys(引导) O23 - 服务: hhhqcz46 (hhhqcz46) - System32/DRIVERS/hhhqcz46.sys(引导) O23 - 服务: idnaux (idnaux) - system32/drivers/idnaux.sys | CNNIC idnaux | 2, 6, 0, 0 | 国际化域名支持模块 | Copyright ? 2005 | 2, 6, 0, 0 | 中国互联网络信息中心(CNNIC) | | idnaux | idnaux.sys(自动) O23 - 服务: IQXEMTAHOWC (OYGOWEMUCJRZJQ) - C:/WINDOWS/system32/svchost.exe -k AIPYFNUB -> C:/Windows/system32/wbem/JQYENTZFMSYEKQ.DLL | 2000-10-22 0:19:22(自动) O23 - 服务: jfwjoo56 (jfwjoo56) - System32/DRIVERS/jfwjoo56.sys(引导) O23 - 服务: q5j6iyhhw (q5j6iyhhw) - C:/WINDOWS/system32/drivers/q5j6iyhhw.sys | 2004-8-17 12:0:0(自动) O23 - 服务: ServicevcHelp (ServicevcHelp) - C:/WINDOWS/system32/vcplay.exe | 2005-11-21 19:48:2 | | 1.0.0.0 | | | 1.0.0.5 | | | | (禁用) O23 - 服务: svchost (svchost) - C:/WINDOWS/system32/dllcache/svchost.exe -g | 2005-11-21 19:40:58 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?(自动) O23 - 服务: W32Time (Windows Time) - C:/WINDOWS/System32/svchost.exe -k netsvcs -> C:/WINDOWS/inf/wnlyuhkh.dll | 2000-10-22 0:21:30(自动) O23 - 服务: Wdswsdewn (Telephotsgoogle) - C:/WINDOWS/system32/serdst.exe | 2000-10-22 0:29:18(自动) O23 - 服务: zefdcx (zefdcx) - System32/DRIVERS/zefdcx.sys(引导) O24 - ShlExecHook: [] - {0EA66AD2-CF26-2E23-532B-B292E22F3266} = C:/Program Files/Internet Explorer/PLUGINS/NewTemp.dll O24 - ShlExecHook: [HM_WOW] - {383D0D27-789F-4543-9760-D4E199623476} = C:/WINDOWS/system32/gwhqiotagms.dll O24 - ShlExecHook: [] - {AAF3B135-E338-491A-B3CB-9D75DA02C5D1} = C:/Program Files/Internet Explorer/PLUGINS/NinSys74.Sys O24 - ShlExecHook: [Microsoft Data Tools Query Designe] - {09F8A0EB-ED61-4714-B0AD-7EAFF5361A8B} = C:/WINDOWS/system32/zhjtrx.dll O24 - ShlExecHook: [] - {5BD41097-3693-4133-820E-FDAC57AF00E2} = C:/Program Files/Internet Explorer/PLUGINS/NvSys74.Sys O24 - ShlExecHook: [] - {C5E87A05-F463-4841-B19E-DD3EC3862368} = C:/Program Files/Internet Explorer/IEXPLORE32.Sys O24 - ShlExecHook: [] - {EE12D60D-AD9A-4095-B839-3BE6862679FD} = C:/Program Files/Internet Explorer/IEXPLORE32.Dat O24 - ShlExecHook: [] - {A45B2C37-01D0-4D3E-BE5E-CC119B17BE9E} = C:/Program Files/Internet Explorer/IEXPLORE32.win HKLM/SHOWALL 值非1 ===/
