解析者: Raymart Christian Yambot   
 別名:

Trojan.Win32.Bingoml.abpu (KASPERSKY)

 プラットフォーム:

Windows

 危険度:
 ダメージ度:
 感染力:
 感染確認数:
 情報漏えい:

  • マルウェアタイプ:
    潜在的に迷惑なアプリケーション

  • 破壊活動の有無:
    なし

  • 暗号化:
     

  • 感染報告の有無 :
    はい

  概要

感染経路 インターネットからのダウンロード, 他のマルウェアからの作成

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 12,374,157 bytes
タイプ EXE
メモリ常駐 なし
発見日 2023年11月30日
ペイロード ファイルの作成, システムのレジストリの変更, ファイルの作成

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

プログラムは、以下のファイルを作成します。

  • %User Temp%\AppData\Local\Temp\is-7K94V.tmp\test.tmp
  • %User Temp%\AppData\Local\Temp\Setup Log 2023-12-08 #001.txt
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\isxdl.dll
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\ADPCleaner.exe
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\ADPCleaner.exe.config
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\DSModuleChecker.x64.exe
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\DSModuleChecker.x64.exe.config
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\DSModuleChecker.x86.exe
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\DSModuleChecker.x86.exe.config
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\ADPCleaner.2023.12.08.log
  • %User Profile%\{Malware file name}-inst.log
  • %User Profile%\wnjp\{Malware file name}\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\.config\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\.config\ap\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\en\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\Icons\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\ja\is-{Random Characters}.tmp;
  • %User Profile%\wnjp\{Malware file name}\vc10\x64\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\is-{Random Characters}.tmp
  • %User Temp%\is-AC6KH.tmp\ADPCleaner.2023.12.08.log
  • %User Profile%\wnjp\{Malware file name}\ADPCleaner.exe.config
  • %User Profile%\wnjp\{Malware file name}\ADPLauncher.exe
  • %User Profile%\wnjp\{Malware file name}\ADPLauncher.exe.config
  • %User Profile%\wnjp\{Malware file name}\ADPLauncher.pdb
  • %User Profile%\wnjp\{Malware file name}\Batch.ini
  • %User Profile%\wnjp\{Malware file name}\ChangeOsrStart.exe
  • %User Profile%\wnjp\{Malware file name}\ChangeOsrStart.exe.config
  • %User Profile%\wnjp\{Malware file name}\CheckReady.exe
  • %User Profile%\wnjp\{Malware file name}\CheckReady.exe.config
  • %User Profile%\wnjp\{Malware file name}\ClientIDGenerator.exe
  • %User Profile%\wnjp\{Malware file name}\ClientIDgenerator.exe.config
  • %User Profile%\wnjp\{Malware file name}\ClientStub_CSharp.dll
  • %User Profile%\wnjp\{Malware file name}\Commons.dll
  • %User Profile%\wnjp\{Malware file name}\D-Interface.dll
  • %User Profile%\wnjp\{Malware file name}\DDEOpen.exe
  • %User Profile%\wnjp\{Malware file name}\DDEOpen.exe.config
  • %User Profile%\wnjp\{Malware file name}\DPSImportTool.exe
  • %User Profile%\wnjp\{Malware file name}\DPSImportTool.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSAgent.exe
  • %User Profile%\wnjp\{Malware file name}\DSAgent.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSAgentUtil.exe
  • %User Profile%\wnjp\{Malware file name}\DSAgentUtil.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSApps.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSApps.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSAux.exe
  • %User Profile%\wnjp\{Malware file name}\DSAux.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSBackupUtil.exe
  • %User Profile%\wnjp\{Malware file name}\DSBrowseHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSBrowseHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSClib.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSClientMonitor.exe
  • %User Profile%\wnjp\{Malware file name}\DSClientMonitor.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSClipboard.exe
  • %User Profile%\wnjp\{Malware file name}\DSClipboard.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSCmd.x64.exe
  • %User Profile%\wnjp\{Malware file name}\DSCmd.x86.exe
  • %User Profile%\wnjp\{Malware file name}\DSComTool.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSComTool.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorAux.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorAux.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorDlg.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorDlg.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSCore.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSCore.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSCoreLite.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSCoreLite.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorExt.dll
  • %User Profile%\wnjp\{Malware file name}\DSCtrl.dll
  • %User Profile%\wnjp\{Malware file name}\DSDeployService.exe
  • %User Profile%\wnjp\{Malware file name}\DSDeployService.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSDeployShared.dll
  • %User Profile%\wnjp\{Malware file name}\DSDriver32.sys
  • %User Profile%\wnjp\{Malware file name}\DSDriver64.sys
  • %User Profile%\wnjp\{Malware file name}\DSDumpCmd.exe
  • %User Profile%\wnjp\{Malware file name}\DSDumpCmd.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSExec.exe
  • %User Profile%\wnjp\{Malware file name}\DSExec.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSExplorer.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSExplorer.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSFireWall.exe
  • %User Profile%\wnjp\{Malware file name}\DSFireWall.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSFS.dll
  • %User Profile%\wnjp\{Malware file name}\DSFSEncDec5.exe
  • %User Profile%\wnjp\{Malware file name}\DSFSEncDec5.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSInject.x64.exe
  • %User Profile%\wnjp\{Malware file name}\DSInject.x86.exe
  • %User Profile%\wnjp\{Malware file name}\DSInst.exe
  • %User Profile%\wnjp\{Malware file name}\DSInst.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSInstall.exe
  • %User Profile%\wnjp\{Malware file name}\DSInstall.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSLauncher.exe
  • %User Profile%\wnjp\{Malware file name}\DSLauncher.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSLib.dll
  • %User Profile%\wnjp\{Malware file name}\DSLoader.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSLoader.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSLoaderInj.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSLoaderInj.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSMessage.exe
  • %User Profile%\wnjp\{Malware file name}\DSMessage.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSMic.exe
  • %User Profile%\wnjp\{Malware file name}\DSMic.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSMic.vshost.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSModuleChecker.x64.exe
  • %User Profile%\wnjp\{Malware file name}\DSModuleChecker.x64.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSModuleChecker.x86.exe
  • %User Profile%\wnjp\{Malware file name}\DSModuleChecker.x86.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSPatcher.exe
  • %User Profile%\wnjp\{Malware file name}\DSPatcher.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSPatcher.vshost.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSPhotoViewer.exe
  • %User Profile%\wnjp\{Malware file name}\DSPhotoViewer.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSReg.exe
  • %User Profile%\wnjp\{Malware file name}\DSReg.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSRestore.exe
  • %User Profile%\wnjp\{Malware file name}\DSRestore.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSSetting.ini
  • %User Profile%\wnjp\{Malware file name}\DSSettingUpdator.exe
  • %User Profile%\wnjp\{Malware file name}\DSSettingUpdator.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSShared.dll
  • %User Profile%\wnjp\{Malware file name}\DSSysHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSSysHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSUI.exe
  • %User Profile%\wnjp\{Malware file name}\DSUI.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSUILauncher.exe
  • %User Profile%\wnjp\{Malware file name}\DSUILauncher.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSUpdateService.exe
  • %User Profile%\wnjp\{Malware file name}\DSUtil.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSUtil.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSValidateCmd.exe
  • %User Profile%\wnjp\{Malware file name}\DSValidateCmd.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSValidateCmd.vshost.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSVault-x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSVault-x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSWndHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSWndHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSZip.exe
  • %User Profile%\wnjp\{Malware file name}\DSZip.exe.config
  • %User Profile%\wnjp\{Malware file name}\DS_x64.exe
  • %User Profile%\wnjp\{Malware file name}\DS_x86.exe
  • %User Profile%\wnjp\{Malware file name}\Dump.DSAgent.2015.08.18.txt
  • %User Profile%\wnjp\{Malware file name}\EnvDTE.dll
  • %User Profile%\wnjp\{Malware file name}\EnvDTE.xml
  • %User Profile%\wnjp\{Malware file name}\explorer.exe.config
  • %User Profile%\wnjp\{Malware file name}\fixWMI_x64.bat
  • %User Profile%\wnjp\{Malware file name}\fixWMI_x86.bat
  • %User Profile%\wnjp\{Malware file name}\FluentFTP.dll
  • %User Profile%\wnjp\{Malware file name}\FVCDown.exe
  • %User Profile%\wnjp\{Malware file name}\FVCDown.exe.config
  • %User Profile%\wnjp\{Malware file name}\FVLoader.x64.dll
  • %User Profile%\wnjp\{Malware file name}\FVLoader.x86.dll
  • %User Profile%\wnjp\{Malware file name}\ICSharpCode.SharpZipLib.dll
  • %User Profile%\wnjp\{Malware file name}\Interop.NetFwTypeLib.dll
  • %User Profile%\wnjp\{Malware file name}\Interop.SHDocVw.dll
  • %User Profile%\wnjp\{Malware file name}\KP-ImageViewerV2.dll
  • %User Profile%\wnjp\{Malware file name}\log4net.dll
  • %User Profile%\wnjp\{Malware file name}\mhook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\mhook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.MSXML.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.OLE.Interop.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.OLE.Interop.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.ProjectAggregator.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.ProjectAggregator.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.Shell.Interop.8.0.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.Shell.Interop.8.0.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.Shell.Interop.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.Shell.Interop.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.TextManager.Interop.8.0.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.TextManager.Interop.8.0.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.TextManager.Interop.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.TextManager.Interop.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.VSHelp.dll
  • %User Profile%\wnjp\{Malware file name}\MinHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\MinHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\NetworkUtil.x64.dll
  • %User Profile%\wnjp\{Malware file name}\NetworkUtil.x86.dll
  • %User Profile%\wnjp\{Malware file name}\Newtonsoft.Json.dll
  • %User Profile%\wnjp\{Malware file name}\Newtonsoft.Json.pdb
  • %User Profile%\wnjp\{Malware file name}\Newtonsoft.Json.xml
  • %User Profile%\wnjp\{Malware file name}\NLog.config
  • %User Profile%\wnjp\{Malware file name}\NLog.dll
  • %User Profile%\wnjp\{Malware file name}\NLog.xml
  • %User Profile%\wnjp\{Malware file name}\NVelocity.dll
  • %User Profile%\wnjp\{Malware file name}\ObjectListView.dll
  • %User Profile%\wnjp\{Malware file name}\SQLite.Designer.dll
  • %User Profile%\wnjp\{Malware file name}\SQLite.Designer.xml
  • %User Profile%\wnjp\{Malware file name}\SQLite.Interop.dll
  • %User Profile%\wnjp\{Malware file name}\stdole.dll
  • %User Profile%\wnjp\{Malware file name}\System.Data.SQLite.dll
  • %User Profile%\wnjp\{Malware file name}\System.Data.SQLite.xml
  • %User Profile%\wnjp\{Malware file name}\VDiskMgr.exe
  • %User Profile%\wnjp\{Malware file name}\version.properties
  • %User Profile%\wnjp\{Malware file name}\WJExpAux.dll
  • %User Profile%\wnjp\{Malware file name}\WJExpHok.x64.dll
  • %User Profile%\wnjp\{Malware file name}\WJExpHok.x86.dll
  • %User Profile%\wnjp\{Malware file name}\WnjCopy.exe
  • %User Profile%\wnjp\{Malware file name}\WnjLine.x64.dll
  • %User Profile%\wnjp\{Malware file name}\WnjLine.x86.dll
  • %User Profile%\wnjp\{Malware file name}\WnjQQ.x64.dll
  • %User Profile%\wnjp\{Malware file name}\WnjQQ.x86.dll
  • %User Profile%\wnjp\{Malware file name}\.config\AppConfig.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ConfigList.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ProcessList.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ProcessListFV2.ini
  • %User Profile%\wnjp\{Malware file name}\.config\RobotConfig.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ScreenList.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ScreenListEx.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acadlt.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acdsee10.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acdsee15.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acdseeqv10.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acdseeqv15.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\aclt.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acrobat.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acrord32.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\alias.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\allegro.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\camnt95.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\capture.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\catstart.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cedt.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cinema 4d.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\client99se.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cnext.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\context.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\coreldrw.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cutepdf.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cutepdfe.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\designer.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\draftsight.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\dwgeditor.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\dwgviewr.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\dxp.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\edge.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\editpadlite7.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\eDrawings.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\eDrawings.exe.prop
  • %User Profile%\wnjp\{Malware file name}\.config\ap\emodelviewer.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\et.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\excel.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\fluent.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\foxit reader.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\foxitreader.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\fsviewer.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\gvim.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\illustrator.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\indesign.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\inventor.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\inventor.exe.prop
  • %User Profile%\wnjp\{Malware file name}\.config\ap\i_view32.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\i_view64.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\madedit.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\msaccess.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\mspaint.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\mtb.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\multisim.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\netbeans64.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\notepad++.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\notepad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\notepad.exe.prop
  • %User Profile%\wnjp\{Malware file name}\.config\ap\paintdotnet.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\patran.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pdfxcview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\photoshop.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\picpick.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pm65.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pm65c.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pm70.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pn.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\powerpcb.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\powerpnt.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\productview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\proe.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pspad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\quarkspress.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\quarkxpress passport.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\revit.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\screencapturer.exe.prop
  • %User Profile%\wnjp\{Malware file name}\.config\ap\seviewer.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\siwave.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\sldworks.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\soffice.bin.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\twincad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\uedit32.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\ugraf.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\visio.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\VisView.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\winproj.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\winword.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\wordpad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\wordview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\wpp.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\wps.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\xlview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\xnview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\xtop.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\zwcad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\DSBackup.{Date}.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\DSDeploy.{Date}.log.txt
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\DSDeploy.{Date}.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\ftp.chck.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\ftp.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\ftp.one.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\ftp.two.log
  • %User Profile%\wnjp\{Malware file name}\.config\session\DSAgent.vshost.exe_1_748
  • %User Profile%\wnjp\{Malware file name}\en\DSAgent.resources.dll
  • %User Profile%\wnjp\{Malware file name}\en\DSClipboard.resources.dll
  • %User Profile%\wnjp\{Malware file name}\en\DSLib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\en\DSUI.resources.dll
  • %User Profile%\wnjp\{Malware file name}\en\DSZip.resources.dll
  • %User Profile%\wnjp\{Malware file name}\fa\DSAgent.resources.dll
  • %User Profile%\wnjp\{Malware file name}\fa\DSLib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\fa\DSUI.resources.dll
  • %User Profile%\wnjp\{Malware file name}\Icons\dsecurity.ico
  • %User Profile%\wnjp\{Malware file name}\Icons\dsvault.ico
  • %User Profile%\wnjp\{Malware file name}\Icons\key.ico
  • %User Profile%\wnjp\{Malware file name}\Icons\key2.ico
  • %User Profile%\wnjp\{Malware file name}\ja\DSAgent.resources.dll
  • %User Profile%\wnjp\{Malware file name}\ja\DSLib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\ja\DSUI.resources.dll
  • %User Profile%\wnjp\{Malware file name}\vc10\x64\mfc100u.dll
  • %User Profile%\wnjp\{Malware file name}\vc10\x64\msvcr100.dll
  • %User Profile%\wnjp\{Malware file name}\vc10\x86\mfc100u.dll
  • %User Profile%\wnjp\{Malware file name}\vc10\x86\msvcr100.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CHT\mscorlib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSAgent.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSClipboard.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSLib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSUI.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSZip.resources.dll
  • %User Profile%\adp-inst.log

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %User Profile%フォルダは、現在ログオンしているユーザのプロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞" です。)

プログラムは、以下のプロセスを追加します。

  • "%User Temp%\is-{Random Characters}.tmp\{Malware file name}.tmp" /SL5="$1D0180,11935019,121344,%User Temp%\{Malware file name}.exe"
  • "%User Temp%\is-{Random Characters}.tmp\ADPCleaner.exe" false "%User Profile%\wnjp\{Malware file name}"
  • "%User Temp%\is-{Random Characters}.tmp\ADPCleaner.exe" false "%Program Files%\wnjp\{Malware file name}"
  • "%User Profile%\wnjp\{Malware file name}\DSFireWall.exe"

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %User Profile%フォルダは、現在ログオンしているユーザのプロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞" です。. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。)

プログラムは、以下のフォルダを作成します。

  • %User Profile%\wnjp
  • %User Profile%\wnjp\{Malware file name}
  • %User Profile%\wnjp\{Malware file name}\.config
  • %User Profile%\wnjp\{Malware file name}\.config\ap
  • %User Profile%\wnjp\{Malware file name}\.config\deploy
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log
  • %User Profile%\wnjp\{Malware file name}\.config\session
  • %User Profile%\wnjp\{Malware file name}\en
  • %User Profile%\wnjp\{Malware file name}\fa
  • %User Profile%\wnjp\{Malware file name}\Icons
  • %User Profile%\wnjp\{Malware file name}\ja
  • %User Profile%\wnjp\{Malware file name}\vc10
  • %User Profile%\wnjp\{Malware file name}\vc10\x64
  • %User Profile%\wnjp\{Malware file name}\vc10\x86
  • %User Profile%\wnjp\{Malware file name}\zh-CHT
  • %User Profile%\wnjp\{Malware file name}\zh-CN

(註：%User Profile%フォルダは、現在ログオンしているユーザのプロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞" です。)

他のシステム変更

プログラムは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Classes\
.iadp
(Default) = iadp_auto_file

HKEY_CURRENT_USER\Software\Classes\
iadp_auto_file
(Default) =

HKEY_CURRENT_USER\Software\Classes\
iadp_auto_file\shell\open\
command
(Default) = "%User Profile%\wnjp\{Malware file name}\ADPLauncher.exe" "%1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.iadp\OpenWithList
a = ADPLauncher.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.iadp\OpenWithList
MRUList = a

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.iadp\OpenWithProgids
iadp_auto_file = hex(0):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter = 62

その他

プログラムは、以下のレジストリキーを追加します。

HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\.iadp

HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\iadp_auto_file

HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\iadp_auto_file\
shell

HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\iadp_auto_file\
shell\open

HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\iadp_auto_file\
shell\open\command

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.iadp

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.iadp\OpenWithList

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.iadp\OpenWithProgids

  対応方法

対応検索エンジン: 9.800
SSAPI パターンバージョン: 2.681.00
SSAPI パターンリリース日: 2023年12月14日

手順 1

Windows 7、Windows 8、Windows 8.1、および Windows 10 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

このマルウェアもしくはアドウェア等の実行により、手順中に記載されたすべてのファイル、フォルダおよびレジストリキーや値がコンピュータにインストールされるとは限りません。インストールが不完全である場合の他、オペレーティングシステム（OS）の条件によりインストールがされない場合が考えられます。手順中に記載されたファイル／フォルダ／レジストリ情報が確認されない場合、該当の手順の操作は不要ですので、次の手順に進んでください。

手順 3

このレジストリキーを削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\.iadp
  • In HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\iadp_auto_file
  • In HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\iadp_auto_file\shell
  • In HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\iadp_auto_file\shell\open
  • In HKEY_CURRENT_USER\S-1-5-21-2019512041-4230814187-3178073052-1000_CLASSES\iadp_auto_file\shell\open\command
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iadp
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iadp\OpenWithList
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iadp\OpenWithProgids

手順 4

このレジストリ値を削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Classes\.iadp
    • (Default) = iadp_auto_file
  • In HKEY_CURRENT_USER\Software\Classes\iadp_auto_file
    • (Default) =
  • In HKEY_CURRENT_USER\Software\Classes\iadp_auto_file\shell\open\command
    • (Default) = "%User Profile%\wnjp\{Malware file name}\ADPLauncher.exe" "%1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iadp\OpenWithList
    • a = ADPLauncher.exe
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iadp\OpenWithList
    • MRUList = a
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iadp\OpenWithProgids
    • iadp_auto_file = hex(0):
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
    • GlobalAssocChangedCounter = 62

手順 5

以下のフォルダを検索し削除します。

[ 詳細 ]
フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。  
  • %User Profile%\wnjp
  • %User Profile%\wnjp\{Malware file name}
  • %User Profile%\wnjp\{Malware file name}\.config
  • %User Profile%\wnjp\{Malware file name}\.config\ap
  • %User Profile%\wnjp\{Malware file name}\.config\deploy
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log
  • %User Profile%\wnjp\{Malware file name}\.config\session
  • %User Profile%\wnjp\{Malware file name}\en
  • %User Profile%\wnjp\{Malware file name}\fa
  • %User Profile%\wnjp\{Malware file name}\Icons
  • %User Profile%\wnjp\{Malware file name}\ja
  • %User Profile%\wnjp\{Malware file name}\vc10
  • %User Profile%\wnjp\{Malware file name}\vc10\x64
  • %User Profile%\wnjp\{Malware file name}\vc10\x86
  • %User Profile%\wnjp\{Malware file name}\zh-CHT
  • %User Profile%\wnjp\{Malware file name}\zh-CN

手順 6

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %User Temp%\AppData\Local\Temp\is-7K94V.tmp\test.tmp
  • %User Temp%\AppData\Local\Temp\Setup Log 2023-12-08 #001.txt
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\isxdl.dll
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\ADPCleaner.exe
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\ADPCleaner.exe.config
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\DSModuleChecker.x64.exe
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\DSModuleChecker.x64.exe.config
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\DSModuleChecker.x86.exe
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\DSModuleChecker.x86.exe.config
  • %User Temp%\AppData\Local\Temp\is-OIJ4K.tmp\ADPCleaner.2023.12.08.log
  • %User Profile%\{Malware file name}-inst.log
  • %User Profile%\wnjp\{Malware file name}\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\.config\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\.config\ap\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\en\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\Icons\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\ja\is-{Random Characters}.tmp;
  • %User Profile%\wnjp\{Malware file name}\vc10\x64\is-{Random Characters}.tmp
  • %User Profile%\wnjp\{Malware file name}\is-{Random Characters}.tmp
  • %User Temp%\is-AC6KH.tmp\ADPCleaner.2023.12.08.log
  • %User Profile%\wnjp\{Malware file name}\ADPCleaner.exe.config
  • %User Profile%\wnjp\{Malware file name}\ADPLauncher.exe
  • %User Profile%\wnjp\{Malware file name}\ADPLauncher.exe.config
  • %User Profile%\wnjp\{Malware file name}\ADPLauncher.pdb
  • %User Profile%\wnjp\{Malware file name}\Batch.ini
  • %User Profile%\wnjp\{Malware file name}\ChangeOsrStart.exe
  • %User Profile%\wnjp\{Malware file name}\ChangeOsrStart.exe.config
  • %User Profile%\wnjp\{Malware file name}\CheckReady.exe
  • %User Profile%\wnjp\{Malware file name}\CheckReady.exe.config
  • %User Profile%\wnjp\{Malware file name}\ClientIDGenerator.exe
  • %User Profile%\wnjp\{Malware file name}\ClientIDgenerator.exe.config
  • %User Profile%\wnjp\{Malware file name}\ClientStub_CSharp.dll
  • %User Profile%\wnjp\{Malware file name}\Commons.dll
  • %User Profile%\wnjp\{Malware file name}\D-Interface.dll
  • %User Profile%\wnjp\{Malware file name}\DDEOpen.exe
  • %User Profile%\wnjp\{Malware file name}\DDEOpen.exe.config
  • %User Profile%\wnjp\{Malware file name}\DPSImportTool.exe
  • %User Profile%\wnjp\{Malware file name}\DPSImportTool.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSAgent.exe
  • %User Profile%\wnjp\{Malware file name}\DSAgent.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSAgentUtil.exe
  • %User Profile%\wnjp\{Malware file name}\DSAgentUtil.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSApps.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSApps.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSAux.exe
  • %User Profile%\wnjp\{Malware file name}\DSAux.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSBackupUtil.exe
  • %User Profile%\wnjp\{Malware file name}\DSBrowseHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSBrowseHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSClib.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSClientMonitor.exe
  • %User Profile%\wnjp\{Malware file name}\DSClientMonitor.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSClipboard.exe
  • %User Profile%\wnjp\{Malware file name}\DSClipboard.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSCmd.x64.exe
  • %User Profile%\wnjp\{Malware file name}\DSCmd.x86.exe
  • %User Profile%\wnjp\{Malware file name}\DSComTool.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSComTool.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorAux.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorAux.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorDlg.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorDlg.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSCore.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSCore.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSCoreLite.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSCoreLite.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSCorExt.dll
  • %User Profile%\wnjp\{Malware file name}\DSCtrl.dll
  • %User Profile%\wnjp\{Malware file name}\DSDeployService.exe
  • %User Profile%\wnjp\{Malware file name}\DSDeployService.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSDeployShared.dll
  • %User Profile%\wnjp\{Malware file name}\DSDriver32.sys
  • %User Profile%\wnjp\{Malware file name}\DSDriver64.sys
  • %User Profile%\wnjp\{Malware file name}\DSDumpCmd.exe
  • %User Profile%\wnjp\{Malware file name}\DSDumpCmd.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSExec.exe
  • %User Profile%\wnjp\{Malware file name}\DSExec.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSExplorer.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSExplorer.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSFireWall.exe
  • %User Profile%\wnjp\{Malware file name}\DSFireWall.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSFS.dll
  • %User Profile%\wnjp\{Malware file name}\DSFSEncDec5.exe
  • %User Profile%\wnjp\{Malware file name}\DSFSEncDec5.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSInject.x64.exe
  • %User Profile%\wnjp\{Malware file name}\DSInject.x86.exe
  • %User Profile%\wnjp\{Malware file name}\DSInst.exe
  • %User Profile%\wnjp\{Malware file name}\DSInst.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSInstall.exe
  • %User Profile%\wnjp\{Malware file name}\DSInstall.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSLauncher.exe
  • %User Profile%\wnjp\{Malware file name}\DSLauncher.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSLib.dll
  • %User Profile%\wnjp\{Malware file name}\DSLoader.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSLoader.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSLoaderInj.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSLoaderInj.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSMessage.exe
  • %User Profile%\wnjp\{Malware file name}\DSMessage.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSMic.exe
  • %User Profile%\wnjp\{Malware file name}\DSMic.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSMic.vshost.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSModuleChecker.x64.exe
  • %User Profile%\wnjp\{Malware file name}\DSModuleChecker.x64.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSModuleChecker.x86.exe
  • %User Profile%\wnjp\{Malware file name}\DSModuleChecker.x86.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSPatcher.exe
  • %User Profile%\wnjp\{Malware file name}\DSPatcher.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSPatcher.vshost.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSPhotoViewer.exe
  • %User Profile%\wnjp\{Malware file name}\DSPhotoViewer.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSReg.exe
  • %User Profile%\wnjp\{Malware file name}\DSReg.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSRestore.exe
  • %User Profile%\wnjp\{Malware file name}\DSRestore.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSSetting.ini
  • %User Profile%\wnjp\{Malware file name}\DSSettingUpdator.exe
  • %User Profile%\wnjp\{Malware file name}\DSSettingUpdator.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSShared.dll
  • %User Profile%\wnjp\{Malware file name}\DSSysHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSSysHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSUI.exe
  • %User Profile%\wnjp\{Malware file name}\DSUI.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSUILauncher.exe
  • %User Profile%\wnjp\{Malware file name}\DSUILauncher.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSUpdateService.exe
  • %User Profile%\wnjp\{Malware file name}\DSUtil.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSUtil.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSValidateCmd.exe
  • %User Profile%\wnjp\{Malware file name}\DSValidateCmd.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSValidateCmd.vshost.exe.config
  • %User Profile%\wnjp\{Malware file name}\DSVault-x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSVault-x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSWndHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\DSWndHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\DSZip.exe
  • %User Profile%\wnjp\{Malware file name}\DSZip.exe.config
  • %User Profile%\wnjp\{Malware file name}\DS_x64.exe
  • %User Profile%\wnjp\{Malware file name}\DS_x86.exe
  • %User Profile%\wnjp\{Malware file name}\Dump.DSAgent.2015.08.18.txt
  • %User Profile%\wnjp\{Malware file name}\EnvDTE.dll
  • %User Profile%\wnjp\{Malware file name}\EnvDTE.xml
  • %User Profile%\wnjp\{Malware file name}\explorer.exe.config
  • %User Profile%\wnjp\{Malware file name}\fixWMI_x64.bat
  • %User Profile%\wnjp\{Malware file name}\fixWMI_x86.bat
  • %User Profile%\wnjp\{Malware file name}\FluentFTP.dll
  • %User Profile%\wnjp\{Malware file name}\FVCDown.exe
  • %User Profile%\wnjp\{Malware file name}\FVCDown.exe.config
  • %User Profile%\wnjp\{Malware file name}\FVLoader.x64.dll
  • %User Profile%\wnjp\{Malware file name}\FVLoader.x86.dll
  • %User Profile%\wnjp\{Malware file name}\ICSharpCode.SharpZipLib.dll
  • %User Profile%\wnjp\{Malware file name}\Interop.NetFwTypeLib.dll
  • %User Profile%\wnjp\{Malware file name}\Interop.SHDocVw.dll
  • %User Profile%\wnjp\{Malware file name}\KP-ImageViewerV2.dll
  • %User Profile%\wnjp\{Malware file name}\log4net.dll
  • %User Profile%\wnjp\{Malware file name}\mhook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\mhook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.MSXML.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.OLE.Interop.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.OLE.Interop.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.ProjectAggregator.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.ProjectAggregator.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.Shell.Interop.8.0.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.Shell.Interop.8.0.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.Shell.Interop.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.Shell.Interop.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.TextManager.Interop.8.0.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.TextManager.Interop.8.0.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.TextManager.Interop.dll
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.TextManager.Interop.xml
  • %User Profile%\wnjp\{Malware file name}\Microsoft.VisualStudio.VSHelp.dll
  • %User Profile%\wnjp\{Malware file name}\MinHook.x64.dll
  • %User Profile%\wnjp\{Malware file name}\MinHook.x86.dll
  • %User Profile%\wnjp\{Malware file name}\NetworkUtil.x64.dll
  • %User Profile%\wnjp\{Malware file name}\NetworkUtil.x86.dll
  • %User Profile%\wnjp\{Malware file name}\Newtonsoft.Json.dll
  • %User Profile%\wnjp\{Malware file name}\Newtonsoft.Json.pdb
  • %User Profile%\wnjp\{Malware file name}\Newtonsoft.Json.xml
  • %User Profile%\wnjp\{Malware file name}\NLog.config
  • %User Profile%\wnjp\{Malware file name}\NLog.dll
  • %User Profile%\wnjp\{Malware file name}\NLog.xml
  • %User Profile%\wnjp\{Malware file name}\NVelocity.dll
  • %User Profile%\wnjp\{Malware file name}\ObjectListView.dll
  • %User Profile%\wnjp\{Malware file name}\SQLite.Designer.dll
  • %User Profile%\wnjp\{Malware file name}\SQLite.Designer.xml
  • %User Profile%\wnjp\{Malware file name}\SQLite.Interop.dll
  • %User Profile%\wnjp\{Malware file name}\stdole.dll
  • %User Profile%\wnjp\{Malware file name}\System.Data.SQLite.dll
  • %User Profile%\wnjp\{Malware file name}\System.Data.SQLite.xml
  • %User Profile%\wnjp\{Malware file name}\VDiskMgr.exe
  • %User Profile%\wnjp\{Malware file name}\version.properties
  • %User Profile%\wnjp\{Malware file name}\WJExpAux.dll
  • %User Profile%\wnjp\{Malware file name}\WJExpHok.x64.dll
  • %User Profile%\wnjp\{Malware file name}\WJExpHok.x86.dll
  • %User Profile%\wnjp\{Malware file name}\WnjCopy.exe
  • %User Profile%\wnjp\{Malware file name}\WnjLine.x64.dll
  • %User Profile%\wnjp\{Malware file name}\WnjLine.x86.dll
  • %User Profile%\wnjp\{Malware file name}\WnjQQ.x64.dll
  • %User Profile%\wnjp\{Malware file name}\WnjQQ.x86.dll
  • %User Profile%\wnjp\{Malware file name}\.config\AppConfig.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ConfigList.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ProcessList.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ProcessListFV2.ini
  • %User Profile%\wnjp\{Malware file name}\.config\RobotConfig.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ScreenList.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ScreenListEx.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acadlt.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acdsee10.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acdsee15.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acdseeqv10.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acdseeqv15.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\aclt.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acrobat.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\acrord32.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\alias.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\allegro.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\camnt95.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\capture.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\catstart.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cedt.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cinema 4d.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\client99se.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cnext.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\context.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\coreldrw.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cutepdf.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\cutepdfe.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\designer.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\draftsight.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\dwgeditor.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\dwgviewr.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\dxp.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\edge.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\editpadlite7.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\eDrawings.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\eDrawings.exe.prop
  • %User Profile%\wnjp\{Malware file name}\.config\ap\emodelviewer.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\et.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\excel.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\fluent.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\foxit reader.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\foxitreader.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\fsviewer.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\gvim.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\illustrator.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\indesign.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\inventor.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\inventor.exe.prop
  • %User Profile%\wnjp\{Malware file name}\.config\ap\i_view32.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\i_view64.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\madedit.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\msaccess.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\mspaint.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\mtb.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\multisim.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\netbeans64.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\notepad++.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\notepad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\notepad.exe.prop
  • %User Profile%\wnjp\{Malware file name}\.config\ap\paintdotnet.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\patran.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pdfxcview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\photoshop.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\picpick.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pm65.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pm65c.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pm70.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pn.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\powerpcb.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\powerpnt.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\productview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\proe.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\pspad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\quarkspress.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\quarkxpress passport.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\revit.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\screencapturer.exe.prop
  • %User Profile%\wnjp\{Malware file name}\.config\ap\seviewer.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\siwave.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\sldworks.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\soffice.bin.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\twincad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\uedit32.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\ugraf.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\visio.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\VisView.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\winproj.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\winword.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\wordpad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\wordview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\wpp.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\wps.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\xlview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\xnview.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\xtop.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\ap\zwcad.exe.ini
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\DSBackup.{Date}.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\DSDeploy.{Date}.log.txt
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\DSDeploy.{Date}.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\ftp.chck.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\ftp.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\ftp.one.log
  • %User Profile%\wnjp\{Malware file name}\.config\deploy\log\ftp.two.log
  • %User Profile%\wnjp\{Malware file name}\.config\session\DSAgent.vshost.exe_1_748
  • %User Profile%\wnjp\{Malware file name}\en\DSAgent.resources.dll
  • %User Profile%\wnjp\{Malware file name}\en\DSClipboard.resources.dll
  • %User Profile%\wnjp\{Malware file name}\en\DSLib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\en\DSUI.resources.dll
  • %User Profile%\wnjp\{Malware file name}\en\DSZip.resources.dll
  • %User Profile%\wnjp\{Malware file name}\fa\DSAgent.resources.dll
  • %User Profile%\wnjp\{Malware file name}\fa\DSLib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\fa\DSUI.resources.dll
  • %User Profile%\wnjp\{Malware file name}\Icons\dsecurity.ico
  • %User Profile%\wnjp\{Malware file name}\Icons\dsvault.ico
  • %User Profile%\wnjp\{Malware file name}\Icons\key.ico
  • %User Profile%\wnjp\{Malware file name}\Icons\key2.ico
  • %User Profile%\wnjp\{Malware file name}\ja\DSAgent.resources.dll
  • %User Profile%\wnjp\{Malware file name}\ja\DSLib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\ja\DSUI.resources.dll
  • %User Profile%\wnjp\{Malware file name}\vc10\x64\mfc100u.dll
  • %User Profile%\wnjp\{Malware file name}\vc10\x64\msvcr100.dll
  • %User Profile%\wnjp\{Malware file name}\vc10\x86\mfc100u.dll
  • %User Profile%\wnjp\{Malware file name}\vc10\x86\msvcr100.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CHT\mscorlib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSAgent.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSClipboard.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSLib.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSUI.resources.dll
  • %User Profile%\wnjp\{Malware file name}\zh-CN\DSZip.resources.dll
  • %User Profile%\adp-inst.log

手順 7

最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「PUA.Win32.AdpSecurity.A」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。


ご利用はいかがでしたか？　アンケートにご協力ください