病毒backdoor/heidong.2005.hook怎麼殺？

[psac]

Q:
病毒backdoor/heidong.2005.hook怎麼殺？
今天用江民2005發現在C:\WINNT\system32\keyspy.dll中有backdoor/heidong.2005.hook病毒，移除失敗，提示重啟移除。重啟還能殺出來，怎麼辦？




A:

用HijackThis 掃瞄一個logfile,把內容貼上來以方便分析~
1. 下載 HijackThis 1.99.1,儲存到桌面後再解壓
http://www.spywareinfo.com/~merijn/files/hijackthis.zip
2. 執行hijackthis.exe,按"Do a system scan and save a logfile"
3. 掃瞄完成後,一個記事本視窗把會彈出來,把內容貼上來

PS: 請勿自行胡亂修復HijackThis掃瞄內的項目



Q:

Logfile of HijackThis v1.99.1
Scan saved at 17:26:36 上午, on 2005-8-23
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\rundl32.exe
C:\WINNT\dlhost.exe
D:\PROGRA~1\江民\KV2005\KVSrvXP_1.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.EXE
D:\Program Files\FireWall\PFW.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\internat.exe
D:\Program Files\Bizpartner\Agent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\PhotoshopCS 8.01\Photoshop.exe
D:\Program Files\迅雷4\Thunder\Thunder.exe
D:\Program Files\迅雷4\Thunder\TDUpdate.exe
D:\Program Files\迅雷4\Thunder\MediaIssue\Issue.exe
C:\Documents and Settings\Administrator\桌面\hijackthis\HijackThis.exe

R3 - URLSearchHook: 上網助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v5.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\adobe Reader 7.01\ActiveX\AcroIEHelper.dll
O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - D:\Program Files\江民\KV2005\KvShell_1.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\CONFLICT.2\barhelp.dll (file missing)
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\DOWNLO~1\CnsHook.dll
O2 - BHO: SFP Class - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - C:\WINNT\system32\Sbhoplin.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,電台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 天下搜尋 - {56A7DC70-E102-4408-A34A-AE06FEF01586} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: 上網助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll