PUA.Win32.AdvWinUtilities.A

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

プログラムは、以下のプロセスを追加します。

• %User Temp%\is-P87JP.tmp\rkverify.exe

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

プログラムは、以下のフォルダを作成します。

• %Program Files%\Advanced Win Utilities Free\skin
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup
• %User Temp%\nsd2904348865490\images
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager
• %Program Files%\Advanced Win Utilities Free
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe
• %Program Files%\Advanced Win Utilities Free\prog\EmptyFolderRemoval\exe
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe
• %User Temp%\nsd2904348865490\css\sdk-ui\images
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe
• %User Temp%\nsd2904348865490\css
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator
• %Program Files%\Advanced Win Utilities Free\prog\Shredder
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup
• %Program Files%\Advanced Win Utilities Free\prog\FileLock
• %Program Files%\Advanced Win Utilities Free\prog\EmptyFolderRemoval
• %User Temp%\nsd2904348865490\css\sdk-ui
• %User Temp%\nsd2904348865490
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor
• %User Temp%\ns14AB5EB1
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe
• %User Temp%\is-P87JP.tmp\_isetup
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval
• %User Temp%\nsd2904348865490\locale
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe
• %Program Files%\Advanced Win Utilities Free\prog
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup

(註：%Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。)

自動実行方法

プログラムは、Windows起動時に自動実行されるよう＜User Startup＞フォルダ内に以下のファイルを作成します。

• %User Startup%\Advanced Win Utilities Free Update.lnk

(註：%User Startup%フォルダは、現在ログオンしているユーザのスタートアップフォルダです。Windows 98およびMEの場合、通常 "C:\Windows\Profiles\＜ユーザ名＞\Start Menu\Programs\Startup" です。Windows NTの場合、通常 "C:\WINNT\Profiles\＜ユーザ名＞\Start Menu\Programs\Startup" です。Windows 2003(32-bit)、XP、2000(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Start Menu\Programs\Startup" です。Windows Vista、7、8、 8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" です。)

他のシステム変更

プログラムは、以下のファイルを削除します。

• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Advanced Win Utilities Free.url
• %Desktop%\Advanced Win Utilities Free.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\More Free Tools.pif
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Advanced Win Utilities Free.pif
• %Start Menu%\Advanced Win Utilities Free.url
• %Start Menu%\Advanced Win Utilities Free.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free.pif
• %Desktop%\Advanced Win Utilities Free.url
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free.url
• %User Startup%\Advanced Win Utilities Free Update.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\More Free Tools.lnk
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Uninstall.pif
• %User Temp%\nsd2904348865490\bootstrap_22046.html
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Uninstall.url
• %User Startup%\Advanced Win Utilities Free Update.url
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free on the Web.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free on the Web.lnk

(註：%Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。. %Desktop%フォルダは、現在ログオンしているユーザのデスクトップです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Desktop" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\Desktop" です。. %All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。. %Start Menu%フォルダは、現在ログオンしているユーザのスタートメニューフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Windows\Start Menu" または "C:\Documents and Settings\＜ユーザ名＞\Start Menu" です。また、Windows Vista、7、8、8.1、2008(64-bit)、012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu" です。. %User Startup%フォルダは、現在ログオンしているユーザのスタートアップフォルダです。Windows 98およびMEの場合、通常 "C:\Windows\Profiles\＜ユーザ名＞\Start Menu\Programs\Startup" です。Windows NTの場合、通常 "C:\WINNT\Profiles\＜ユーザ名＞\Start Menu\Programs\Startup" です。Windows 2003(32-bit)、XP、2000(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Start Menu\Programs\Startup" です。Windows Vista、7、8、 8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" です。. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

プログラムは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Owner = "\xec\x04\x00\x00\xeb\xc7\x92\xc0@\xdc\xd5\x01"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
SessionHash = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Sequence = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Shell Extensions\
Cached
{random string} = "\x01\x00\x00\x00\x00\x00\x00\x00F\xa5\xfe\x83\xdc\xd5\x01"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFiles0000 = "\x00\x00\x00tP\xe4\x81\x81Z\xe5\x90\x90\xef\x80\x80\x04\xe1\x80\x80t\xe6\xad\xa0"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFilesHash = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: Setup Version = "6.0.3 (u)"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: App Path = "%Program Files%\Advanced Win Utilities Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
InstallLocation = "%Program Files%\Advanced Win Utilities Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: Icon Group = "Advanced Win Utilities Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: User = "{username}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: Language = "en_1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
DisplayName = "Advanced Win Utilities Free 8.8.2.6"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
UninstallString = "%Program Files%\Advanced Win Utilities Free\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
QuietUninstallString = "%Program Files%\Advanced Win Utilities Free\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Publisher = "Win Utilities Software, Inc."

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
URLInfoAbout = "http://www.{BLOCKED}ilities.net"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
HelpLink = "http://www.{BLOCKED}ilities.net"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
URLUpdateInfo = "http://www.{BLOCKED}ilities.net"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
InstallDate = "20200206"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
EstimatedSize = "75223"

作成活動

プログラムは、以下のファイルを作成します。

• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-NBQ28.tmp
• %Program Files%\Advanced Win Utilities Free\is-CO00H.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\DiskCleanup.exe
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-8N6KT.tmp
• %User Temp%\nsd2904348865490\locale\ML.locale
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\is-UADO4.tmp
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\is-N50MN.tmp
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\UI.jpg
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\FileLock.exe
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\is-8J20D.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\FileFolderMonitor.exe
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\UI.bmp
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\DuplicatesRemoval.exe
• %User Temp%\nsd2904348865490\locale\MR.locale
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\is-POV41.tmp
• %Program Files%\Advanced Win Utilities Free\skin\is-AK5D6.tmp
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\Microsoft.WindowsAPICodePack.Shell.dll
• %User Temp%\nsd2904348865490\locale\LV.locale
• %User Temp%\nsd2904348865490\css\sdk-ui\button.css
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\logo.png
• %Program Files%\Advanced Win Utilities Free\is-CKFNF.tmp
• %User Temp%\nsd2904348865490\locale\BG.locale
• %User Temp%\01BB2D52.log
• %User Temp%\nsd2904348865490\locale\KA.locale
• %Program Files%\Advanced Win Utilities Free\skin\is-RFKQ4.tmp
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\is-8GMM2.tmp
• %User Temp%\nsd2904348865490\locale\FA.locale
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\is-BDEGQ.tmp
• %User Temp%\nsd2904348865490\locale\CA.locale
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free.lnk
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\is-MBJN8.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\browse.css
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\is-QCBVO.tmp
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\is-0726M.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\FileSplitterJoiner.exe
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\is-3NHD8.tmp
• %User Temp%\is-P87JP.tmp\ezdatzsazzxt.dll
• %User Temp%\nsd2904348865490\locale\SK.locale
• %User Temp%\nsd2904348865490\locale\MK.locale
• %User Temp%\nsd2904348865490\locale\PS.locale
• %User Temp%\is-P87JP.tmp\RKBanner.bmp
• %User Temp%\01BB2D42.log
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\BrokenShortcutRemova.exe
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\More Free Tools.url
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\lamecore.dll
• %User Temp%\nsd2904348865490\locale\TH.locale
• %Program Files%\Advanced Win Utilities Free\Advanced Win Utilities Free Update.exe
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\is-1R7HG.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\is-PEV27.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-CO4AF.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\is-RK633.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-6JUCP.tmp
• %Program Files%\Advanced Win Utilities Free\skin\youtubemisc_panel.bmp
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Uninstall.lnk
• %Program Files%\Advanced Win Utilities Free\skin\active.bmp
• %Desktop%\Advanced Win Utilities Free.lnk
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\AutoClicker.exe
• %User Temp%\nsd2904348865490\locale\LT.locale
• %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
• %User Temp%\nsd2904348865490\locale\RO.locale
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\is-1L1HJ.tmp
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\is-0D3B4.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\is-8MVV8.tmp
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\Interop.NETCONLib.dll
• %User Temp%\nsd2904348865490\locale\YO.locale
• %User Temp%\nsd2904348865490\css\sdk-ui\progress-bar.css
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\is-7UJOR.tmp
• %User Temp%\nsd2904348865490\locale\ET.locale
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe\Tsing Tools.dll
• %User Temp%\nsd2904348865490\locale\EU.locale
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\is-6LL5V.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\icon.ico
• %User Temp%\nsd2904348865490\locale\IT.locale
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free on the Web.url
• %User Temp%\nsd2904348865490\locale\HT.locale
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\is-E51JO.tmp
• %User Temp%\nsd2904348865490\locale\HU.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\system.dat
• %User Temp%\nsd2904348865490\csshover3.htc
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\is-061GV.tmp
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\is-SH5IV.tmp
• %User Temp%\is-P87JP.tmp\rkverify.exe
• %User Temp%\nsd2904348865490\locale\KK.locale
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\FileSystems.dll
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\ProgramLock.exe
• %User Temp%\nsd2904348865490\locale\FI.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-MR5B5.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\version.dat
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\is-IBFMB.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\DriverBackup.exe
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\skin\is-HO9LA.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\is-N78Q2.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\core.dll
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\WiFiHotspotCreator.exe
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\is-NVLU0.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\is-0T764.tmp
• %User Temp%\nsd2904348865490\locale\AF.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\lamecore.dll
• %User Temp%\nsd2904348865490\locale\SL.locale
• %Program Files%\Advanced Win Utilities Free\skin\normal.bmp
• %Program Files%\Advanced Win Utilities Free\skin\photoimages_panel.bmp
• %User Temp%\nsd2904348865490\locale\TA.locale
• %Program Files%\Advanced Win Utilities Free\unins000.dat
• %Program Files%\Advanced Win Utilities Free\is-NNRRQ.tmp
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\Tsing Tools.dll
• %User Temp%\nsd2904348865490\locale\TL.locale
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\is-JBPLR.tmp
• %User Temp%\nsd2904348865490\locale\HI.locale
• %User Temp%\nsd2904348865490\locale\VI.locale
• %User Temp%\nsd2904348865490\locale\PT.locale
• %User Temp%\nsd2904348865490\locale\UK.locale
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\is-F9RIR.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\images\button-bg.png
• %User Temp%\nsd2904348865490\locale\TR.locale
• %User Temp%\nsd2904348865490\css\ie6_main.css
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\lamecore.dll
• %User Temp%\01BB2B01.log
• %User Temp%\nsd2904348865490\locale\ID.locale
• %Program Files%\Advanced Win Utilities Free\prog\EmptyFolderRemoval\exe\is-AMO6P.tmp
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe\Tsing Tools.dll
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\is-E80TN.tmp
• %User Temp%\nsd2904348865490\locale\ES.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-OLOL0.tmp
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\is-BCH5M.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\is-EFLTB.tmp
• %Program Files%\Advanced Win Utilities Free\skin\layerframemask.bmp
• %User Temp%\nsd2904348865490\locale\SR.locale
• %User Temp%\nsd2904348865490\css\sdk-ui\images\progress-bg.png
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\is-KC48G.tmp
• %Program Files%\Advanced Win Utilities Free\skin\skin.ini
• %Program Files%\Advanced Win Utilities Free\skin\is-ANDHG.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\PasswordManager.exe
• %Program Files%\Advanced Win Utilities Free\skin\is-VKSC8.tmp
• %Start Menu%\Advanced Win Utilities Free.lnk
• %User Temp%\nsd2904348865490\locale\ZH.locale
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\icon.ico
• %User Temp%\nsd2904348865490\locale\UZ.locale
• %Program Files%\Advanced Win Utilities Free\unins000.exe
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe\is-APIDL.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\images\progress-bg-corner.png
• %User Temp%\nsd2904348865490\locale\HE.locale
• %User Temp%\nsd2904348865490\locale\CS.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\Microsoft.WindowsAPICodePack.dll
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe\is-OMTOL.tmp
• %User Temp%\nsd2904348865490\locale\PL.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-FUPUF.tmp
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe\is-0PV3J.tmp
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\EXEResourceExtractor.exe
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\AutoShutdown.exe
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\is-GA0KR.tmp
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe\Tsing Tools.dll
• %Program Files%\Advanced Win Utilities Free\skin\is-M2G85.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\is-S8K1P.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\GuiComponents.dll
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\is-7UJMN.tmp
• %User Temp%\nsd2904348865490\locale\RU.locale
• %User Temp%\nsd2904348865490\locale\GU.locale
• %User Temp%\nsd2904348865490\locale\JA.locale
• %Program Files%\Advanced Win Utilities Free\goup.exe
• %User Temp%\nsd2904348865490\locale\BE.locale
• %User Temp%\nsd2904348865490\locale\LO.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\is-H05KT.tmp
• %Program Files%\Advanced Win Utilities Free\is-04L42.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\UI.bmp
• %User Temp%\nsd2904348865490\locale\KU.locale
• %User Temp%\nsd2904348865490\css\main.css
• %User Temp%\nsd2904348865490\locale\IS.locale
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\is-BFKTT.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\images\progress-bg2.png
• %User Temp%\nsd2904348865490\locale\SQ.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-P0D2D.tmp
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\is-IU5CV.tmp
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\lamecore.dll
• %User Temp%\is-P87JP.tmp\itdownload.dll
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\is-8EPML.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\is-CFVTR.tmp
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\is-UFOBC.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\icon.ico
• %User Temp%\is-P87JP.tmp\rkinstaller.exe
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\is-JHH7N.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\shredder.avi
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Advanced Win Utilities Free.lnk
• %Program Files%\Advanced Win Utilities Free\prog\EmptyFolderRemoval\exe\EmptyFolderRemoval.exe
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe\UninstallManager.exe
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\is-PPNNF.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\icon.ico
• %User Temp%\nsd2904348865490\locale\NE.locale
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\is-VNNEB.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-GAEG8.tmp
• %Program Files%\Advanced Win Utilities Free\skin\is-1NBFQ.tmp
• %User Temp%\nsd2904348865490\locale\BS.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\UI.bmp
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\Interop.NetFwTypeLib.dll
• %Program Files%\Advanced Win Utilities Free\skin\mp3audio_panel.bmp
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\is-LP2QL.tmp
• %User Temp%\nsd2904348865490\locale\NL.locale
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\is-GECLR.tmp
• %User Temp%\nsd2904348865490\locale\FR.locale
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\DeletedFileRecovery.exe
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\lamecore.dll
• %User Temp%\nsd2904348865490\locale\ZU.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\Shredder.exe
• %Program Files%\Advanced Win Utilities Free\is-SNTVL.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\checkbox.css
• %User Temp%\nsd2904348865490\locale\KO.locale
• %User Temp%\nsd2904348865490\locale\SV.locale
• %User Temp%\nsd2904348865490\locale\AZ.locale
• %User Temp%\nsd2904348865490\locale\UR.locale
• %Program Files%\Advanced Win Utilities Free\skin\is-G23IF.tmp
• %User Temp%\nsd2904348865490\locale\HY.locale
• %User Temp%\nsd2904348865490\locale\PA.locale
• %User Temp%\nsd2904348865490\locale\MS.locale
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe\StartupManager.exe
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe\is-9UCEJ.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\is-82R2N.tmp
• %Program Files%\Advanced Win Utilities Free\unins000.msg
• %User Temp%\nsd2904348865490\locale\NO.locale
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe\is-EI8JP.tmp
• %User Temp%\nsd2904348865490\images\Loader.gif
• %User Temp%\nsd2904348865490\locale\DA.locale
• %User Temp%\nsd2904348865490\locale\EL.locale
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe\WebBrowserCleanup.exe
• %Program Files%\Advanced Win Utilities Free\AdvancedWinUtilitiesFree.exe
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\Ionic.Zip.dll
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\RegistryCleanup.exe
• %Program Files%\Advanced Win Utilities Free\skin\is-9UG45.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-TU05E.tmp
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\is-INSRF.tmp
• %Program Files%\Advanced Win Utilities Free\skin\dvdvideo_panel.bmp
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\is-A3QTJ.tmp
• %User Temp%\nsd2904348865490\locale\EN.locale
• %User Temp%\nsd2904348865490\locale\DE.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-HSMCH.tmp
• %User Temp%\nsd2904348865490\locale\HR.locale
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe\is-NURVT.tmp
• %Program Files%\Advanced Win Utilities Free\skin\layerframe.bmp
• %User Temp%\nsd2904348865490\locale\TE.locale
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\lamecore.dll

(註：%Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。. %Desktop%フォルダは、現在ログオンしているユーザのデスクトップです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Desktop" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\Desktop" です。. %AppDataLocal%フォルダは、ローカルアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local" です。. %Start Menu%フォルダは、現在ログオンしているユーザのスタートメニューフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Windows\Start Menu" または "C:\Documents and Settings\＜ユーザ名＞\Start Menu" です。また、Windows Vista、7、8、8.1、2008(64-bit)、012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu" です。. %Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。)

その他

プログラムは、以下の不正なWebサイトにアクセスします。

• http://rp.{BLOCKED}verseapplication.com
• http://os.{BLOCKED}verseapplication.com
• http://post.{BLOCKED}studies.com/packages/RI1034/ContentI3.exe
• http://post.{BLOCKED}studies.com/packages/RV0267/ContentV3.exe
• http://post.{BLOCKED}studies.com/TapAction.aspx?{random characters}
• http://dpd.{BLOCKED}studies.com

このウイルス情報は、自動解析システムにより作成されました。