PUA.Win32.TweakBit.AJ

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

プログラムは、以下のプロセスを追加します。

• %User Temp%\is-3K4PC.tmp\reader.exe "{malware file path and name}" "(x32)HKEY_LOCAL_MACHINE\Software\TweakBit\PCRepairKit\2.x\Settings"
• "%System%\regsvr32.exe" /s "%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x64.dll"
• "%System%\regsvr32.exe" /s "%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x32.dll"
• "%System%\regsvr32.exe" /s "%Program Files%\TweakBit\PCRepairKit\BrowserPluginsHelper.Agent.x64.dll"
• "%System%\regsvr32.exe" /s "%Program Files%\TweakBit\PCRepairKit\BrowserPluginsHelper.Agent.x32.dll"
• %Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe /Install /Language:"ENU" /AutoStart /SendInfo
• %System%\svchost.exe -k netsvcs

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。)

プログラムは、以下のフォルダを作成します。

• %Program Files%\TweakBit\PCRepairKit\Lang
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit
• %All Users Profile%\TweakBit
• %User Temp%\is-3K4PC.tmp\_isetup
• %All Users Profile%\TweakBit\PCRepairKit\2.x
• %All Users Profile%\TweakBit\PCRepairKit\2.x\Logs
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit
• %Program Files%\TweakBit\PCRepairKit
• %Program Files%\TweakBit\PCRepairKit\Data
• %User Temp%\PCRepairKit.madExcept
• %All Users Profile%\TweakBit\PCRepairKit
• %Program Files%\TweakBit

(註：%Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

他のシステム変更

プログラムは、以下のファイルを削除します。

• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.url
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.pif
• %Desktop%\TweakBit PCRepairKit.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.lnk
• %Desktop%\TweakBit PCRepairKit.url
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.pif
• %User Temp%\PCRepairKit.madExcept
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.url

(註：%All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。. %Desktop%フォルダは、現在ログオンしているユーザのデスクトップです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Desktop" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\Desktop" です。. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

プログラムは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Owner = "X\x03\x00\x00A\xe2\x91s\x04\xdc\xd5\x01"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
SessionHash = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Sequence = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{527595C7-F26B-21A6-DFBC-B4B4145467D0}\
Version
Assembly = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
General.Language = "ENU"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
General.Tracking.Param_Source = "pc-repair-kit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
General.Tracking.URLMarkers = "\x00\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
General.Tracking.URLMarkers = "\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
Application.PurchaseUrlParam = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
General.DoNotAddUtmToUrls = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit
ClientID = "{64EEA55C-DC0D-4E4E-8F3C-10BC582BB4B6}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFiles0000 = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFilesHash = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\ATUpdaters\1.x\
Settings
Shared.Blocking.PCRepairKit = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: Setup Version = "5.5.9 (u)"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: App Path = "%Program Files%\TweakBit\PCRepairKit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
InstallLocation = "%Program Files%\TweakBit\PCRepairKit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: Icon Group = "TweakBit\PCRepairKit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: User = "{username}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: Language = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
DisplayName = "TweakBit PCRepairKit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
DisplayIcon = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
QuietUninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
DisplayVersion = "2.0.0.55435"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Publisher = "Tweakbit Pty Ltd"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
URLInfoAbout = "http://www.{BLOCKED}it.com/support/contact"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
HelpLink = "http://www.{BLOCKED}it.com/en/support.php"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
URLUpdateInfo = "http://www.{BLOCKED}it.com/pc-repair-kit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Contact = "info@tweakbit.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
InstallDate = "20200205"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
MajorVersion = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
MinorVersion = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
VersionMajor = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
VersionMinor = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
EstimatedSize = "80815"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /compability"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}
(Default) = "IBCAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\
ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\
TypeLib
(Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
AppID = "{93469602-4134-4012-A6BC-FD34B37A0C36}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{93469602-4134-4012-A6BC-FD34B37A0C36}
DllSurrogate = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
(Default) = "TweakBit BCAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
InprocServer32
(Default) = "%Program Files%\TweakBit\PCREPA~1\BRC692~1.DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
InprocServer32
ThreadingModel = "Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
BCAgentCOM32.BCAgent32
(Default) = "TweakBit BCAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
BCAgentCOM32.BCAgent32\Clsid
(Default) = "{93469602-4134-4012-A6BC-FD34B37A0C36}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
ProgID
(Default) = "BCAgentCOM32.BCAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
Version
(Default) = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
TypeLib
(Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3CC2E0D5-193C-4192-B8BA-50EF3EB4E055}
(Default) = "IBrowserPluginsAgent64"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3CC2E0D5-193C-4192-B8BA-50EF3EB4E055}\
ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3CC2E0D5-193C-4192-B8BA-50EF3EB4E055}\
TypeLib
(Default) = "{F2C6F7D1-ED32-49E5-9919-F7311905F122}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3CC2E0D5-193C-4192-B8BA-50EF3EB4E055}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{93469602-4134-4012-A6BC-8724B0C6EFF4}
AppID = "{93469602-4134-4012-A6BC-8724B0C6EFF4}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{93469602-4134-4012-A6BC-8724B0C6EFF4}
DllSurrogate = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{93469602-4134-4012-A6BC-8724B0C6EFF4}
(Default) = "TweakBit BrowserPluginsAgent64"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{93469602-4134-4012-A6BC-8724B0C6EFF4}\InprocServer32
(Default) = "%Program Files%\TweakBit\PCREPA~1\BRBADF~1.DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{93469602-4134-4012-A6BC-8724B0C6EFF4}\InprocServer32
ThreadingModel = "Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
BrowserPluginsAgentCOM64.BrowserPluginsAgent64
(Default) = "TweakBit BrowserPluginsAgent64"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
BrowserPluginsAgentCOM64.BrowserPluginsAgent64\Clsid
(Default) = "{93469602-4134-4012-A6BC-8724B0C6EFF4}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{93469602-4134-4012-A6BC-8724B0C6EFF4}\ProgID
(Default) = "BrowserPluginsAgentCOM64.BrowserPluginsAgent64"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{93469602-4134-4012-A6BC-8724B0C6EFF4}\Version
(Default) = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{93469602-4134-4012-A6BC-8724B0C6EFF4}\TypeLib
(Default) = "{F2C6F7D1-ED32-49E5-9919-F7311905F122}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}
(Default) = "IBrowserPluginsAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
(Default) = "TweakBit BrowserPluginsAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
InprocServer32
(Default) = "%Program Files%\TweakBit\PCREPA~1\BR0D94~1.DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
BrowserPluginsAgentCOM32.BrowserPluginsAgent32
(Default) = "TweakBit BrowserPluginsAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
BrowserPluginsAgentCOM32.BrowserPluginsAgent32\Clsid
(Default) = "{93469602-4134-4012-A6BC-FD34B37A0C36}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
ProgID
(Default) = "BrowserPluginsAgentCOM32.BrowserPluginsAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
General.InstallDateTime = "\x06j\x80\xb4Qk\xe5@"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
Application.AutoStartEnable = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
Application.FileName = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
Application.AutoScan.Enabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\2.x\
Settings
Application.AutoScan.TimeStamp = "\x00`\x9e\xe5\xa0M\x16@"

作成活動

プログラムは、以下のファイルを作成します。

• %Program Files%\TweakBit\PCRepairKit\TweakManager.exe
• %Program Files%\TweakBit\PCRepairKit\is-18NQ5.tmp
• %User Temp%\is-3K4PC.tmp\ita.lng
• %Program Files%\TweakBit\PCRepairKit\RegistryDefragHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-4L1DC.tmp
• %User Temp%\is-3K4PC.tmp\CFAHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-SAD6N.tmp
• %Program Files%\TweakBit\PCRepairKit\Lang\esp.lng
• %User Temp%\is-3K4PC.tmp\vclimg250.bpl
• %Program Files%\TweakBit\PCRepairKit\Data\is-9BD9D.tmp
• %Program Files%\TweakBit\PCRepairKit\is-2F59F.tmp
• %Program Files%\TweakBit\PCRepairKit\RescueCenter.exe
• %Program Files%\TweakBit\PCRepairKit\is-TT6PP.tmp
• %Program Files%\TweakBit\PCRepairKit\is-OCGFD.tmp
• %Program Files%\TweakBit\PCRepairKit\TweakManagerHelper.dll
• %Program Files%\TweakBit\PCRepairKit\rdboot64.exe
• %Program Files%\TweakBit\PCRepairKit\unins000.exe
• %Program Files%\TweakBit\PCRepairKit\Data\main.ini
• %Program Files%\TweakBit\PCRepairKit\Lang\is-0MJ15.tmp
• %Program Files%\TweakBit\PCRepairKit\is-H1484.tmp
• %Program Files%\TweakBit\PCRepairKit\rtl250.bpl
• %User Temp%\is-3K4PC.tmp\fra.lng
• %Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict
• %Program Files%\TweakBit\PCRepairKit\is-M1U4P.tmp
• %Program Files%\TweakBit\PCRepairKit\is-1B5FV.tmp
• %Program Files%\TweakBit\PCRepairKit\is-MJORA.tmp
• %Program Files%\TweakBit\PCRepairKit\Lang\fra.lng
• %Program Files%\TweakBit\PCRepairKit\is-5MQ6K.tmp
• %Program Files%\TweakBit\PCRepairKit\SpywareCheckerHelper.dll
• %Program Files%\TweakBit\PCRepairKit\VolumesHelper.dll
• %Program Files%\TweakBit\PCRepairKit\sqlite3.dll
• %Program Files%\TweakBit\PCRepairKit\CommonForms.dll
• %User Temp%\is-3K4PC.tmp\downloader.exe
• %User Temp%\is-3K4PC.tmp\PCRepairKit.exe
• %Program Files%\TweakBit\PCRepairKit\Data\is-5SMVC.tmp
• %Program Files%\TweakBit\PCRepairKit\BrowserPluginsHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-5UHGF.tmp
• %Program Files%\TweakBit\PCRepairKit\is-6OF01.tmp
• %Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe
• %User Temp%\is-3K4PC.tmp\sqlite3.dll
• %User Temp%\is-3K4PC.tmp\CommonForms.Site.dll
• %Program Files%\TweakBit\PCRepairKit\is-8QSDM.tmp
• %Program Files%\TweakBit\PCRepairKit\Lang\is-HGFLE.tmp
• %Program Files%\TweakBit\PCRepairKit\is-9OJMH.tmp
• %Program Files%\TweakBit\PCRepairKit\rdboot32.exe
• %Program Files%\TweakBit\PCRepairKit\vcl250.bpl
• %Program Files%\TweakBit\PCRepairKit\is-JK96R.tmp
• %Desktop%\TweakBit PCRepairKit.lnk
• %Program Files%\TweakBit\PCRepairKit\is-B7LNN.tmp
• %User Temp%\is-3K4PC.tmp\esp.lng
• %Program Files%\TweakBit\PCRepairKit\is-T7QEQ.tmp
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.lnk
• %Program Files%\TweakBit\PCRepairKit\is-J53VT.tmp
• %User Temp%\is-3K4PC.tmp\ptb.lng
• %Program Files%\TweakBit\PCRepairKit\accessibility_sdk.dll
• %Program Files%\TweakBit\PCRepairKit\unins000.msg
• %User Temp%\is-3K4PC.tmp\GoogleAnalyticsHelper.dll
• %Program Files%\TweakBit\PCRepairKit\PopupsHelper.dll
• %Program Files%\TweakBit\PCRepairKit\Integrator.exe
• %Program Files%\TweakBit\PCRepairKit\is-V0LKV.tmp
• %Program Files%\TweakBit\PCRepairKit\TaskSchedulerHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-6GM4P.tmp
• %User Temp%\is-3K4PC.tmp\main.ini
• %Program Files%\TweakBit\PCRepairKit\is-DPPCN.tmp
• %Program Files%\TweakBit\PCRepairKit\AxComponentsVCL.bpl
• %Program Files%\TweakBit\PCRepairKit\Lang\deu.lng
• %Program Files%\TweakBit\PCRepairKit\Data\is-RF11T.tmp
• %Program Files%\TweakBit\PCRepairKit\RescueCenterForm.dll
• %Program Files%\TweakBit\PCRepairKit\WizardHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-R8JAB.tmp
• %Program Files%\TweakBit\PCRepairKit\DebugHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-K3O2N.tmp
• %Program Files%\TweakBit\PCRepairKit\DuplicateFileFinderHelper.dll
• %Program Files%\TweakBit\PCRepairKit\BrowserPluginsHelper.Agent.x32.dll
• %Program Files%\TweakBit\PCRepairKit\is-6EE4A.tmp
• %Program Files%\TweakBit\PCRepairKit\Data\is-0LGAJ.tmp
• %Program Files%\TweakBit\PCRepairKit\MalwareDetectionHelper.dll
• %Program Files%\TweakBit\PCRepairKit\RescueCenterHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-QNKG9.tmp
• %Program Files%\TweakBit\PCRepairKit\FileShredder.exe
• %Program Files%\TweakBit\PCRepairKit\is-4137R.tmp
• %Program Files%\TweakBit\PCRepairKit\CommonForms.Routine.dll
• %Program Files%\TweakBit\PCRepairKit\is-30S2O.tmp
• %Program Files%\TweakBit\PCRepairKit\Lang\ptb.lng
• %Program Files%\TweakBit\PCRepairKit\is-2RFOQ.tmp
• %Program Files%\TweakBit\PCRepairKit\Lang\is-Q32ER.tmp
• %All Users Profile%\TweakBit\PCRepairKit\2.x\Logs\CheckSerialNumber.log
• %Program Files%\TweakBit\PCRepairKit\Data\hsysfiles.mdict
• %Program Files%\TweakBit\PCRepairKit\Data\hbwlists.mdict
• %Program Files%\TweakBit\PCRepairKit\SystemInformationHelper.dll
• %Program Files%\TweakBit\PCRepairKit\BrowserHelper.dll
• %Program Files%\TweakBit\PCRepairKit\TabReports.exe
• %Program Files%\TweakBit\PCRepairKit\vclimg250.bpl
• %Program Files%\TweakBit\PCRepairKit\is-9KQIT.tmp
• %Program Files%\TweakBit\PCRepairKit\is-LQT55.tmp
• %Program Files%\TweakBit\PCRepairKit\is-S2FFI.tmp
• %Program Files%\TweakBit\PCRepairKit\PCRepairKit.url
• %Program Files%\TweakBit\PCRepairKit\is-CKQK3.tmp
• %Program Files%\TweakBit\PCRepairKit\is-JLSSV.tmp
• %Program Files%\TweakBit\PCRepairKit\GoogleAnalyticsHelper.dll
• %Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x32.dll
• %Program Files%\TweakBit\PCRepairKit\DiskCleanerHelper.dll
• %Program Files%\TweakBit\PCRepairKit\Downloader.exe
• %Program Files%\TweakBit\PCRepairKit\is-UNBAP.tmp
• %Program Files%\TweakBit\PCRepairKit\is-JV00Q.tmp
• %Program Files%\TweakBit\PCRepairKit\CommonForms.Site.dll
• %Program Files%\TweakBit\PCRepairKit\Data\is-F9MIL.tmp
• %AppDataLocal%\GDIPFONTCACHEV1.DAT
• %Program Files%\TweakBit\PCRepairKit\AxComponentsRTL.bpl
• %Program Files%\TweakBit\PCRepairKit\is-P2NK5.tmp
• %User Temp%\is-3K4PC.tmp\WizardHelper.dll
• %Program Files%\TweakBit\PCRepairKit\Data\security_db.dat
• %Program Files%\TweakBit\PCRepairKit\is-5L99F.tmp
• %Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-HLDEN.tmp
• %Program Files%\TweakBit\PCRepairKit\is-HKSN9.tmp
• %Program Files%\TweakBit\PCRepairKit\InternetOptimizerHelper.dll
• %Program Files%\TweakBit\PCRepairKit\RegistryCleanerHelper.dll
• %Program Files%\TweakBit\PCRepairKit\Data\is-PQJJM.tmp
• %User Temp%\is-3K4PC.tmp\AxComponentsRTL.bpl
• %User Temp%\is-3K4PC.tmp\vcl250.bpl
• %User Temp%\is-3K4PC.tmp\deu.lng
• %Program Files%\TweakBit\PCRepairKit\CFAHelper.dll
• %Program Files%\TweakBit\PCRepairKit\Data\is-T4OB6.tmp
• %Program Files%\TweakBit\PCRepairKit\is-E2H87.tmp
• %Program Files%\TweakBit\PCRepairKit\Localizer.dll
• %Program Files%\TweakBit\PCRepairKit\Data\hmthinfo.mdict
• %Program Files%\TweakBit\PCRepairKit\unins000.dat
• %Program Files%\TweakBit\PCRepairKit\is-BMBM5.tmp
• %Program Files%\TweakBit\PCRepairKit\is-ABUIH.tmp
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.url
• %Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x64.dll
• %Program Files%\TweakBit\PCRepairKit\InternetOptimizer.exe
• %Program Files%\TweakBit\PCRepairKit\is-IIIMD.tmp
• %Program Files%\TweakBit\PCRepairKit\Data\hwscheme.mdict
• %Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict-journal
• %Program Files%\TweakBit\PCRepairKit\ReportHelper.dll
• %Program Files%\TweakBit\PCRepairKit\Data\compromised_passwords.txt
• %Program Files%\TweakBit\PCRepairKit\UpdatersHelper.dll
• %Program Files%\TweakBit\PCRepairKit\Lang\ita.lng
• %Program Files%\TweakBit\PCRepairKit\is-55D1T.tmp
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.lnk
• %Program Files%\TweakBit\PCRepairKit\BrowserPluginsHelper.Agent.x64.dll
• %Program Files%\TweakBit\PCRepairKit\is-4BOUV.tmp
• %Program Files%\TweakBit\PCRepairKit\is-LQMP0.tmp
• %Program Files%\TweakBit\PCRepairKit\DuplicateFileFinder.exe
• %Program Files%\TweakBit\PCRepairKit\Lang\is-T4E16.tmp
• %User Temp%\is-3K4PC.tmp\rtl250.bpl
• %Program Files%\TweakBit\PCRepairKit\is-50BC2.tmp
• %Program Files%\TweakBit\PCRepairKit\is-DAJB2.tmp
• %Program Files%\TweakBit\PCRepairKit\Lang\enu.lng
• %Program Files%\TweakBit\PCRepairKit\SendDebugLog.exe
• %User Temp%\is-3K4PC.tmp\AxComponentsVCL.bpl
• %Program Files%\TweakBit\PCRepairKit\is-7SNP8.tmp
• %Program Files%\TweakBit\PCRepairKit\Data\database.dat
• %Program Files%\TweakBit\PCRepairKit\is-7T4IT.tmp
• %User Temp%\is-3K4PC.tmp\Localizer.dll
• %Program Files%\TweakBit\PCRepairKit\Lang\is-H7AC8.tmp
• %Program Files%\TweakBit\PCRepairKit\RegistryDefrag.exe
• %Program Files%\TweakBit\PCRepairKit\Lang\is-PE5CK.tmp
• %Program Files%\TweakBit\PCRepairKit\Data\is-5U3R2.tmp
• %Program Files%\TweakBit\PCRepairKit\is-M5TLQ.tmp
• %Program Files%\TweakBit\PCRepairKit\DiskWipeHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-362D1.tmp
• %Program Files%\TweakBit\PCRepairKit\MalwareHeuristicHelper.dll
• %Program Files%\TweakBit\PCRepairKit\is-SS25H.tmp

(註：%Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Desktop%フォルダは、現在ログオンしているユーザのデスクトップです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Desktop" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\Desktop" です。. %All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。. %AppDataLocal%フォルダは、ローカルアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local" です。)

このウイルス情報は、自動解析システムにより作成されました。