病毒名稱：PortLess BackDoor (IPRIP)
病毒主檔：backexe.exe、hedll.dll、hesys.sys、svchostdll.dll

病毒歷程：(資安論壇得資料)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\PortLess\FdsnqbTsuni`: "tjnkbu"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\PortLess\Wfttphuc: "tofiXdo"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\Security\Security: 01 00 14 80 A0 00 00 00 AC 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 70 00 04 00 00 00 00 00 18 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 63 00 6F 00 00 00 1C 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 6D 00 00 00 00 00 18 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 20 02 00 00 00 00 1C 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 6D 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\Parameters\ServiceDll: "C:\WINNT\system32\Svchostdll.dll"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\Parameters\program: "SvchostDLL.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\Parameters\Interactive: 0x00000000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\Type: 0x00000020
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\Start: 0x00000002
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\ErrorControl: 0x00000001
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\ImagePath: "%SystemRoot%\System32\Svchost.exe -k netsvcs"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\DisplayName: "Intranet Services"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPRIP\ObjectName: "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\Security\Security: 01 00 14 80 A0 00 00 00 AC 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 70 00 04 00 00 00 00 00 18 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 63 00 6F 00 00 00 1C 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 6D 00 00 00 00 00 18 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 20 02 00 00 00 00 1C 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 6D 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\Parameters\ServiceDll: "C:\WINNT\system32\Svchostdll.dll"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\Parameters\program: "SvchostDLL.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\Parameters\Interactive: 0x00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\Type: 0x00000020
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\Start: 0x00000002
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\ErrorControl: 0x00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\ImagePath: "%SystemRoot%\System32\Svchost.exe -k netsvcs"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\DisplayName: "Intranet Services"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIP\ObjectName: "LocalSystem"

可以看出，PortLess BackDoor V1.2將自己註冊為了服務IPRIP，它使用的啟動參數是"%SystemRoot%\System32\Svchost.exe -k netsvcs"

個人處理辦法：
1.發現Svchost.exe將CPU吃光，使用Process Explorer察看此Process發現有支異常程式(hedll.dll)，使用ICESword將他移除(Process Explorer移除不掉)，Process下降。
2.使用SREng察看，發現Service內有不知名服務(因User電腦很亂，看很久).查明服務指向位置，移除程式，至服務指向位置刪除問題檔。
3.重新開機，正常。