今天上午天网提示，有个c:\winnt\system32\perfhmon.exe文件要访问网络，当然被我禁止了。但是禁止之后，所有网页都无法访问，可以Ping通其它机器，QQ也可以使用。查看进程，perfhmon几乎占用了所有的CPU，占用内存数也不停地在涨。结束这个进程，报“无法完成操作。拒绝访问。”。

借用别的机器到网上搜索perfhmon.exe，没找到杀这个毒的方法，于是我自己尝试。

我先到安全模式下，删除注册表中所有含有perfhmon的项和值，但是有几个无法删除，就是HLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_PERFHMON\以及在ControlSet002和ControlSet下面的同样的项。
然后到c:\winnt\system32下面，准备删除perfhmon.exe，但是没找到这个文件！

我重启到正常模式下，这个进程已经不存在了，我以为就这么好了，但是到下午，天网又报警，说c:\winn\system32\sss.exe要访问网络，我禁止以后，又是同样的无法访问网页。这回我直接到c:\winnt\system32下面去找这个文件，居然没有找到！（文件夹选项里已选显示所有文件）

我用hijackthis扫描，发现sss.exe跟一个叫Performance Logs的服务有关。查看这个服务，启动类别是“自动”，状态“已启动”。无法停止这个服务，我就把“自动”改成“已禁用”。然后进入安全模式，重新删注册表。搜索sss.exe，还是跟前面一样的几个项，项的名字还是perfhmon，只是里面的键值从perfhmon.exe变成了sss.exe。再搜索performance Logs，找到的就是前面无法删除的几个项，现在仍是无法删除。

再重启，又好了，进程里已经没有sss.exe。但是没多久，天网又跳出警告，提示c:\winnt\system32\rrr.exe要访问网络。我立刻仆桌…………

这病毒有完没完啊～～～～

各位高手帮帮忙啊～～今天我们局域网里有很多机器都中这个毒了～～～～

附hijackthis的报告：
Logfile of HijackThis v1.99.1
Scan saved at 14:33:32, on 2005-8-30
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\www\Apache2\bin\Apache.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\www\MySQL5\bin\mysqld-nt.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
D:\www\Apache2\bin\Apache.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\Rundll32.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Program Files\SkyNet\FireWall\PFW.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\internat.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqmtbrn.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINNT\system32\taskmgr.exe
D:\Program Files\Maxthon\Maxthon.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqsvc.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqmsrvn.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqzxma0.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqxssvn.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqxssvn.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqxssvn.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqzfuma.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqhasmn.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqzllp0.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqrrmfa.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqzdmaa.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqzlaa0.exe
D:\Program Files\IBM\WebSphere MQ\bin\AMQPCSEA.EXE
D:\Program Files\IBM\WebSphere MQ\bin\RUNMQLSR.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqxssvn.exe
E:\福建\fj050824\debug\TeleAsk.exe
D:\Program Files\IBM\WebSphere MQ\bin\RUNMQCHI.exe
D:\Program Files\IBM\WebSphere MQ\bin\runmqchl.EXE
D:\Program Files\IBM\WebSphere MQ\bin\amqzlaa0.exe
D:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\MSDEV.EXE
D:\Program Files\IBM\WebSphere MQ\bin\amqzxma0.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqxssvn.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqxssvn.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqxssvn.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqzfuma.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqhasmn.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqzllp0.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqrrmfa.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqzdmaa.exe
D:\Program Files\IBM\WebSphere MQ\bin\amqzlaa0.exe
D:\Program Files\IBM\WebSphere MQ\bin\AMQPCSEA.EXE
D:\Program Files\IBM\WebSphere MQ\bin\RUNMQLSR.exe
D:\Program Files\IBM\WebSphere MQ\bin\RUNMQCHI.exe
C:\WINNT\system32\conime.exe
E:\福建\fj050824\debug\PrePC.exe
E:\福建\fj050824\debug\MQBridge.exe
C:\WINNT\system32\rrr.exe
D:\Program Files\IBM\WebSphere MQ\bin\AMQRMPPA.EXE
C:\WINNT\regedit.exe
F:\hijackthis1991\HijackThis.exe

R3 - URLSearchHook: BDSrchHook Class - {2C5AA40E-8814-4EB6-876E-7EFB8B3F9662} - C:\WINNT\DOWNLO~1\BDSrHook.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: BDHlprObj Class - {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} - C:\WINNT\DOWNLO~1\BDHelper.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - d:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: IEMoni Class - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - C:\WINNT\system32\Sbhoplin.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [BIE] Rundll32 C:\WINNT\DOWNLO~1\BDPlugin.dll,Rundll32
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SKYNET Personal FireWall] D:\Program Files\SkyNet\FireWall\PFW.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O4 - Startup: 腾讯通.lnk = D:\Program Files\Tencent\BQQ\rtxc.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = D:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Monitor Apache Servers.lnk = D:\www\Apache2\bin\ApacheMonitor.exe
O4 - Global Startup: WebSphere MQ 任务栏.lnk = D:\Program Files\IBM\WebSphere MQ\bin\amqmtbrn.exe
O4 - Global Startup: 服务管理器.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: &Download by NetAnts - D:\PROGRA~1\NetAnts\NAGet.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Download &All by NetAnts - D:\PROGRA~1\NetAnts\NAGetAll.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: NetAnts - {57E91B47-F40A-11D1-B792-444553540000} - D:\PROGRA~1\NetAnts\NetAnts.exe
O9 - Extra 'Tools' menuitem: &NetAnts - {57E91B47-F40A-11D1-B792-444553540000} - D:\PROGRA~1\NetAnts\NetAnts.exe
O9 - Extra button: 词霸 - {9A687CA6-D585-4947-9ED9-BE96071F5CD9} - D:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3BBE5C24-0908-4DA4-905F-3A83D4E1695F} (QMMapObj Class) - http://192.168.1.76/qmap_ll/qmmap.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{09C88CE0-3177-4F48-B461-A46B224C536B}: NameServer = 202.96.209.133,202.96.209.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{09C88CE0-3177-4F48-B461-A46B224C536B}: NameServer = 202.96.209.133,202.96.209.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{09C88CE0-3177-4F48-B461-A46B224C536B}: NameServer = 202.96.209.133,202.96.209.5
O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - D:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2 - Unknown owner - D:\www\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: IBM MQSeries (MQSeriesServices) - IBM 公司 - D:\Program Files\IBM\WebSphere MQ\bin\amqsvc.exe
O23 - Service: MySQL - Unknown owner - D:\www\MySQL5\bin\mysqld-nt".exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - D:\oracle\ora92\bin\omtsreco.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - D:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: Performance Logs (Perfhmon) - Unknown owner - C:\WINNT\system32\rrr.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

现在天网关于rrr.exe的这个框我还保留着，没敢允许也没敢禁止。进程里的rrr.exe还比较老实，没有占用cpu,内存数也只有3668K，没有再涨。请高手们快点支招啊，总不能一直这样勉强撑着～～～

sss.exe,perfhmon.exe和rrr.exe打包传上来,我会通知baohe斑竹的

T T 可是我找不到这几个文件啊…………

在“文件夹选项”的“查看”面板中勾选“显示系统文件”、“显示所有的文件和文件夹”两项，点击“确定”按钮。然后在找

引用:

【命运里の金色的贴子】在“文件夹选项”的“查看”面板中勾选“显示系统文件”、“显示所有的文件和文件夹”两项，点击“确定”按钮。然后在找 ...........................

我忘记把“隐藏受保护的操作系统文件（推荐）”这个选项前面的勾去掉了…………
现在可以看见那几个文件了，打包在附件里。

http://www8.tianyaclub.com/publicforum/Content/it/1/289965.shtml
http://lds.net.cn/index.php?action=show&id=2

这里的症状似乎有点象我们这里的，今天我们这里局域网各服务器的MSSQL服务也停止过，后来打了补丁就好了。

Backdoor.Win32.Codbot.ap