Menghapus Conficker (Net-Worm.Win32.Kido)

Sebelumnya saya pernah membahas tentang infeksi virus Conficker di kantor yang sampai menyebabkan lumpuhnya jaringan komputer secara total, anda dapat membacanya di sini.

Ternyata virus tersebut masih terhitung aktif menyerang di beberapa warnet di surabaya, mungkin hal ini disebabkan karena mudahnya virus dalam melakukan infeksi melalui jaringan, flash-disk (USB-Disk), ataupun media penyimpanan yang sering berpindah tempat (portable).

Seperti pada artikel yang pernah saya posting sebelumnya, ciri komputer yang terinfeksi adalah: lumpuhnya jaringan komputer (lokal/internet) dan juga kemampuan AntiVirus untuk melakukan update virus signature (list virus baru yang telah di identifikasi).

Maka untuk mengingat kembali saya akan postingkan aksi Kaspersky dalam membersihkan virus Conficker dengan removal-tool nya:

Net-Worm.Win32.Kido removing tool, Kaspersky Lab 2009
version 3.4.7   May  5 2009 14:39:10
scanning        jobs ...

scanning        processes ...

scanning        threads ...
Infected thread was killed in process svchost.exe with PID 1264
Infected thread was killed in process svchost.exe with PID 1264
Infected thread was killed in process svchost.exe with PID 1264
Infected thread was killed in process svchost.exe with PID 1264
Infected thread was killed in process svchost.exe with PID 1264
Infected thread was killed in process svchost.exe with PID 1264
Infected thread was killed in process svchost.exe with PID 1264

scanning        modules in svchost.exe...
Spliced function NtQueryInformationProcess fixed in ntdll.dll module
Spliced function NetpwPathCanonicalize fixed in netapi32.dll module
Spliced function NtQueryInformationProcess fixed in ntdll.dll module
Spliced function DnsQuery_A fixed in dnsapi.dll module
Spliced function DnsQuery_UTF8 fixed in dnsapi.dll module
Spliced function DnsQuery_W fixed in dnsapi.dll module
Spliced function Query_Main fixed in dnsapi.dll module
scanning        modules in services.exe...
scanning        modules in explorer.exe...

scanning        C:\WINDOWS\system32 ...
C:\WINDOWS\system32\wjyjn.dll   infected Net-Worm.Win32.Kido ...        cured
scanning        C:\Program Files\Internet Explorer\ ...
scanning        C:\Program Files\Movie Maker\ ...
scanning        C:\Program Files\Windows Media Player\ ...
scanning        C:\Program Files\Windows NT\ ...
scanning        C:\Documents and Settings\Administrator\Application Data ...
scanning        C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ ...

completed
Infected jobs:                  0
Infected files:                 1
Infected threads:               7
Spliced functions:              7
Cured files:                    1
Fixed registry keys:            0

Press any key to continue . . .

removal-tool dapat di download di
http://support.kaspersky.com/faq/?qid=208279973

ditulis oleh: Rud Achmed, 11 September 2009 - dalam: Virus