Ransom_CRYPAURA.SHLDE

手順 1

Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

Windowsをセーフモードで再起動します。

手順 3

このレジストリ値を削除します。

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • 00FFCC58263A = "{malware path and file name} "

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • BCCC58263A = "%User Profile%\Application Data\BCCC58263A.exe "

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • FFCC58263A = "a438a37c-6848-4e75-8403-70088ae68ac2"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "1"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "2"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "3"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "4"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "5"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "6"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "7"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "8"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "9"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "a"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "b"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "c"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "d"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "e"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "f"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "11"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "12"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "13"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "14"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "15"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "16"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "17"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "18"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "19"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "1a"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "1b"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "1c"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "1d"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "1e"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "1f"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "21"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "22"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "23"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "24"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "25"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "26"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "27"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "28"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "29"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "2a"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "2b"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "2c"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "2d"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "2e"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "2f"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "31"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "32"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "33"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "34"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "35"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "36"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "37"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "38"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "39"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "3a"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "3b"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "3c"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "3d"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "3e"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "3f"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "41"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "42"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "43"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "44"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "45"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "46"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "47"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "48"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "49"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "4a"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "4b"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "4c"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "4d"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "4e"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "4f"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "51"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "52"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "53"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "54"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "55"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "56"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "57"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "58"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "59"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "5a"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "5b"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "5c"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "5d"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "5e"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "5f"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "61"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "62"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "63"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "64"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "65"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "66"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "67"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "68"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "69"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "6a"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "6b"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "6c"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "6d"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "6e"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "6f"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "71"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "72"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "73"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "74"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "75"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "76"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "77"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "78"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "79"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "7a"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "7b"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "7c"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "7d"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "7e"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "7f"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "81"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "82"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "83"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "84"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "85"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "86"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "87"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "88"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "89"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "8a"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "8b"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "8c"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "8d"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "8e"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "8f"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "91"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "92"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "93"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "94"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "95"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
  • CC58263A = "96"

手順 4

以下のファイルを検索し削除します。

• %User Profile%\Application Data\AXFCC3C509054X0B7D28ZCDDBB17087B9C3E.MOLE03
• %System Root%\6B7467141D647F5CCF1E74271E5363D0.MOLE03
• %User Profile%\4382B4400813ED70249F0F6C0902D1E4.MOLE03
• %User Profile%\124AE5100A353D97574C66500B24220B.MOLE03
• %User Profile%\Local Settings\89A9FBEE11DB229EC84A00D212CA0712.MOLE03
• %User Profile%\History\6B4957782AF6ABA4AFAA5C8E2BE59018.MOLE03
• %User Profile%\History.IE5\9EFBD9B03A0F21E0C45525933AFE0654.MOLE03
• %User Profile%\History.IE5\A07DB0383F899FA01E827C8440788414.MOLE03
• %User Profile%\SendTo\765B2A2633E24ACCD820B15334D12F40.MOLE03
• %Start Menu%\5D59792020D14EECBF63527821C03360.MOLE03
• %Start Menu%\Programs\E13B16F510B0AA85A929A09F119F8EF9.MOLE03
• %Start Menu%\Programs\A0EB0AF8044719F86601D7340535FE6C.MOLE03
• %Start Menu%\Programs\339502B305EF841DBEBBF83706DE6891.MOLE03
• %Start Menu%\Programs\Accessories\72610C782C9A80905C11B6DD2D896504.MOLE03
• %Start Menu%\Programs\Accessories\92B574B4160CEA9D80ABCCFC16FBCF11.MOLE03
• %Start Menu%\Programs\Accessories\49CB94EC1FDCD5A11B2D07B420CBBA15.MOLE03
• %Start Menu%\Programs\Accessories\170919351C29A07480E2B91B1D1884E8.MOLE03
• %Start Menu%\Programs\Accessories\D1DD264020272A7C0E29E97021160EF0.MOLE03
• %Start Menu%\Programs\Accessories\772ED3090BD1FC7CA87CF7690CC0E0F0.MOLE03
• %Start Menu%\Programs\Accessories\591E658A1DB91F04E1EA02FE1EA80378.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\31A7A7A7285DDFB87553103F294CC42C.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\BA62D2DC2854905911535DBC294374CD.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\1EAC607442A61E1CAD99EC8543950290.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\BEDDE09F25BB9356D1211BD526AA77CA.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\03F2B9241E454590EA7E983E1F342A04.MOLE03
• %Start Menu%\Programs\Accessories\Entertainment\26505E19356689B6021C42DF36556E2A.MOLE03
• %Start Menu%\Programs\Accessories\Entertainment\A69327373A68AAE6B8C67C873B578F5A.MOLE03
• %User Startup%\5464EB44140047747CC64FED14EF2BE8.MOLE03
• %User Profile%\Templates\508DCB9D18416C34FF1CA4C7193050A8.MOLE03
• %User Profile%\Templates\74BF4E8E01201CA0622EF57F020F0114.MOLE03
• %User Profile%\Templates\07AC5D1C12F21108DACFD28B13E0F57C.MOLE03
• %User Profile%\Templates\97343E31398D2E56121B69313A7C12CA.MOLE03
• %User Profile%\Templates\55C1520825DF23F5F6A7C71826CE0869.MOLE03
• %User Profile%\Templates\1FA4144226D499AC075D71F227C37E20.MOLE03
• %User Profile%\Templates\D570DE2804B8BDA6D0EE2F4805A7A21A.MOLE03
• %User Profile%\Templates\FACA285031EF0778857E193C32DDEBEC.MOLE03
• %User Profile%\Templates\A4D76D0C3E5A7CA05F5571993F496114.MOLE03
• %User Profile%\Templates\278F05102721C600450129BD2810AA74.MOLE03
• %User Profile%\Templates\72D9D09241AD81F268182DE2429C6666.MOLE03
• %User Profile%\Templates\F7D8906613761EE38349DE4E14650357.MOLE03
• %User Profile%\20609B54100603602BD83F6710F4E7D4.MOLE03
• %User Profile%\Local Settings\A131E9C6096977A6C5C2775E0A585C1A.MOLE03
• %User Profile%\History\94C70DB619EA2DC228AED8B91AD91236.MOLE03
• %User Profile%\History.IE5\74B2EB16234E5DBEADC112EB243D4232.MOLE03
• %User Profile%\History.IE5\BEC176001E4E704048DBA4201F3D54B4.MOLE03
• %User Profile%\DB4C0DBC3F3E53F23533B0FC402D3866.MOLE03
• %User Profile%\Local Settings\58546EE43B1B3D698E03F6C43C0A21DD.MOLE03
• %User Profile%\History\08C32E9A0AA1C2DCE463A3ED0B90A750.MOLE03
• %User Profile%\History.IE5\D1BB81704515D335ED39CFB04604B7A9.MOLE03
• %User Profile%\D390BDEF36E320AC9096D6B737D20520.MOLE03
• %Favorites%\A7A79A6204F2120627D0A56905E0F67A.MOLE03
• %Favorites%\CF0177381AB79A486B290A711BA67EBC.MOLE03
• %Favorites%\FC34A56E1F2EA75CF9E7CF83201D8BD0.MOLE03
• %Favorites%\Links\215D37960CFEF0C4EF5EBE1F0DEDD538.MOLE03
• %Favorites%\Links\31736B202733A78E4CB482B028228C02.MOLE03
• %Favorites%\Links\6B987C822BCE83D388FAA7DE2CBD6847.MOLE03
• %Favorites%\Links\82A67B344637CB8E4FE19E8E4726B002.MOLE03
• %Favorites%\Links\8ED9AEB201177C06B602C8830206607A.MOLE03
• %User Profile%\Local Settings\42ACCAD03250406857A0DB0A333F24DC.MOLE03
• %User Profile%\History\DDEF84B00B4EBC2F5B69EFD00C3DA0A3.MOLE03
• %User Profile%\History.IE5\0938640014E9F800C060A1A015D8DC74.MOLE03
• %User Profile%\History.IE5\4004B48B15A13D4EA0A49085169021C2.MOLE03
• %User Profile%\MSHist012013061320130614\C5A6C4603DD7E67C3B48AEE03EC6CAF0.MOLE03
• %User Temp%\5D5B04E402BE54188746496403AD388C.MOLE03
• %User Temp%\90D26B6630CEA61FB8B8CE4A31BD8A93.MOLE03
• %User Temp%\6C08867408AD3E24BE6DAFAA099C2298.MOLE03
• %User Temp%\A98875360E21D9681B6A82DF0F10BDDC.MOLE03
• %User Temp%\055443B843EAFC9683DF5F0C44D9E10A.MOLE03
• %User Temp%\98D00D9A15062E0BC4B18C5A15F5127F.MOLE03
• %User Temp%\4598588C3137A63CA256828D32268AB0.MOLE03
• %User Temp%\A657A5B42B743852AEE2A15A2C631CC6.MOLE03
• %User Temp%\A5B4BA450FCD884EC91E445310BC6CC2.MOLE03
• %User Temp%\10B12E3C15048D98CE2C265715F3720C.MOLE03
• %User Temp%\3A06A0DF1D75D3826E20F9F91E9CB7F6.MOLE03
• %User Temp%\149266AA2BA37BC870A4AA812C92603C.MOLE03
• %User Temp%\82015C18408EF6A6B11E4CE84281DB1A.MOLE03
• %User Temp%\9725440105164FAD83EA0FCF07353421.MOLE03
• %User Temp%\B111FE5A273C4D4FC7E530B2295B31C3.MOLE03
• %User Temp%\018F90763DF5A11042BD7DEF40248584.MOLE03
• %User Temp%\034D4A0B35F741F6772C21F736E6266A.MOLE03
• %User Temp%\2BBBA4F808EE9DB0B55294920B0D8224.MOLE03
• %User Temp%\8D32E66B32290185BDA667373457E5F9.MOLE03
• %User Temp%\394B9D800A79ACC07D6DC95A0B689134.MOLE03
• %User Temp%\3465BA583AF5495479BB77943CE82DC8.MOLE03
• %User Temp%\95B9356E1A190F5AE6F33D0B1BE9F3CE.MOLE03
• %User Temp%\224E9CB91FD7C5436CCC4C972244A9B7.MOLE03
• %User Temp%\F5509F6B2710A52332FC2F1928E18997.MOLE03
• %User Temp%\E4574E1C085A4F8A9EB07F4C0A3B33FE.MOLE03
• %User Temp%\8DCBA90045FAED3051153B9046E9D1A4.MOLE03
• %User Temp%\370ABAAF0A788BF667CCB08F0C6B706A.MOLE03
• %User Temp%\1E3DEF1143F2EB1F6664933545C3CF93.MOLE03
• %User Temp%\464C875503BA763EF32C1A9F04A95AB2.MOLE03
• %User Temp%\6A7A83F93B22BEEAFB29149D3C11A35E.MOLE03
• %User Temp%\F4C1B2501E8659E0B4F5F6F020573E54.MOLE03
• %User Temp%\{835818DD-220C-4ABD-946E-0D8660B95E29}\C782217C203B7694DF07E221212A5B08.MOLE03
• %User Profile%\My Documents\B277825F0F2EC4AC2D57A921101DA920.MOLE03
• %User Profile%\My Music\F449AD2044C5CD2848369E2445B4B19C.MOLE03
• %User Profile%\My Music\6096B30639A0BB1ADCC4B44D3B719F8E.MOLE03
• %User Temp%\163FCF60243D632CEAF8FAF826AA47A0.MOLE03
• %User Profile%\My Pictures\571FEF000B6682700AEDC0500D3766E4.MOLE03
• %User Profile%\My Pictures\A6AE708A37F8BDD110E524523AF1A245.MOLE03
• %User Profile%\Recent\44488A523DB948F0FDCF0E5E3F8A2D64.MOLE03
• %User Profile%\SendTo\17B8F7B835A203F65B15C35C3690E86A.MOLE03
• %Start Menu%\2BA3A7D83FD349BBD64B561840C22E2F.MOLE03
• %User Temp%\0F7E313A27D2438CF813D2E72A2F2800.MOLE03
• %Start Menu%\Programs\0AE3C22416769C7F2FA04D2C178D80F3.MOLE03
• %Start Menu%\Programs\559E71EE23E4897352321AF224FB6DE7.MOLE03
• %Start Menu%\Programs\2A88DEBA49FBB028587FBA624AEA949C.MOLE03
• %Start Menu%\Programs\8C6ABC311C11A0CBEE8801C91D00853F.MOLE03
• %Start Menu%\Programs\9AAE68C02CE6E2E07BF6208A2DD5C754.MOLE03
• %Start Menu%\Programs\Accessories\A245DD7B2B6DED501947C5972C5CD1C4.MOLE03
• %Start Menu%\Programs\Accessories\A738FB10230841482E53EF3C23F725BC.MOLE03
• %Start Menu%\Programs\Accessories\E2A033003EC1E000EE6BC7323FB0C474.MOLE03
• %Start Menu%\Programs\Accessories\FB74CE4748979DD2221D56F349868246.MOLE03
• %Start Menu%\Programs\Accessories\2EA592A2123431ACFDE4FBC713231620.MOLE03
• %Start Menu%\Programs\Accessories\128D1AF0262331701969C131271215E4.MOLE03
• %Start Menu%\Programs\Accessories\B8B189C42C4648822FCAC00C2D352CF6.MOLE03
• %Start Menu%\Programs\Accessories\07C3DE3F4D056E2408E5C3314DF45298.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\52DA0BCC44620D641098C8A14550F1D8.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\17D8A9FE0F9C8B762609F32A108B6FEA.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\D33300E83B00D5E42207C9463BEFBA58.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\2E3F202818DB4CC80CD2FAC819CA313C.MOLE03
• %Start Menu%\Programs\Accessories\Accessibility\0CF958D048248EC8C626E0844913733C.MOLE03
• %Start Menu%\Programs\Accessories\Entertainment\B92E95500883966826731F0209727ADC.MOLE03
• %Start Menu%\Programs\Accessories\Entertainment\C55977682C207A48367298DF2D0F5EBC.MOLE03
• %Start Menu%\Programs\Administrative Tools\BED39F184E13A769B8AB9E784F028BDD.MOLE03
• %User Startup%\F1688ADC20A6B40C7EFE5AF221959880.MOLE03
• %User Profile%\Templates\73D86363247E1B5E23FA97BD256CFFD2.MOLE03
• %User Profile%\Templates\03EC77382669C028FCF15E2A2758A49C.MOLE03
• %User Profile%\Templates\81DBEB0D2DC03FCBD1CA19BD2EAF243F.MOLE03
• %User Profile%\Templates\11579E053A1401E2217296793B02E656.MOLE03
• %User Profile%\Templates\2758814A3C586A280E00A2C93D474E9C.MOLE03
• %User Profile%\Templates\E2A372800947B020D9F1E6300A369494.MOLE03
• %User Profile%\Templates\D3806E50027150B8FD612FFE0360352C.MOLE03
• %User Profile%\Templates\E26B49A43F704E812E00CFCC405F32F5.MOLE03
• %User Profile%\Templates\9E44A5611FC524EBE595595520B4095F.MOLE03
• %User Profile%\Templates\BE0ED08A0C583386DF4F964A0D4717FA.MOLE03
• %User Profile%\Templates\872DB1C01B1EE80C1D8E85B01C0DCC80.MOLE03
• %User Profile%\Templates\F712A42026D540C0516F747A27C42534.MOLE03
• %User Profile%\History.IE5\6F8A4D80320DABC0D2601F0633249034.MOLE03
• %User Profile%\History.IE5\5B5656802EEE694293C7178030054DB6.MOLE03
• %User Profile%\History.IE5\BA3D28AE07033F64F748F0C9081A23D8.MOLE03
• %User Profile%\History.IE5\4EF846AC0F101D5AAAFD22FA102701CE.MOLE03
• %User Profile%\History.IE5\AADB8D4C21C3FF035B712F8422DAE377.MOLE03
• %User Profile%\History.IE5\7590D6EE057553B9AF226176068C382D.MOLE03

手順 5

コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「Ransom_CRYPAURA.SHLDE」と検出したファイルの検索を実行してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 6

以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

• %System Root%\boot.ini
• %User Profile%\NTUSER.DAT
• %User Profile%\ntuser.dat.LOG
• %Desktop%.ini
• %User Profile%\History.IE5\index.dat
• %Start Menu%\desktop.ini
• %Start Menu%\Programs\desktop.ini
• %Start Menu%\Programs\Remote Assistance.lnk
• %Start Menu%\Programs\Windows Media Player.lnk
• %Start Menu%\Programs\Accessories\Command Prompt.lnk
• %Start Menu%\Programs\Accessories\desktop.ini
• %Start Menu%\Programs\Accessories\Notepad.lnk
• %Start Menu%\Programs\Accessories\Program Compatibility Wizard.lnk
• %Start Menu%\Programs\Accessories\Synchronize.lnk
• %Start Menu%\Programs\Accessories\Tour Windows XP.lnk
• %Start Menu%\Programs\Accessories\Windows Explorer.lnk
• %Start Menu%\Programs\Accessories\Accessibility\desktop.ini
• %Start Menu%\Programs\Accessories\Accessibility\Magnifier.lnk
• %Start Menu%\Programs\Accessories\Accessibility\Narrator.lnk
• %Start Menu%\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
• %Start Menu%\Programs\Accessories\Accessibility\Utility Manager.lnk
• %Start Menu%\Programs\Accessories\Entertainment\desktop.ini
• %Start Menu%\Programs\Accessories\Entertainment\Windows Media Player.lnk
• %User Startup%\desktop.ini
• %User Profile%\Templates\amipro.sam
• %User Profile%\Templates\excel.xls
• %User Profile%\Templates\excel4.xls
• %User Profile%\Templates\lotus.wk4
• %User Profile%\Templates\powerpnt.ppt
• %User Profile%\Templates\presenta.shw
• %User Profile%\Templates\quattro.wb2
• %User Profile%\Templates\sndrec.wav
• %User Profile%\Templates\winword.doc
• %User Profile%\Templates\winword2.doc
• %User Profile%\Templates\wordpfct.wpd
• %User Profile%\Templates\wordpfct.wpg
• %User Profile%\ntuser.ini
• %Favorites%\MSN.com.url
• %Favorites%\Radio Station Guide.url
• %Favorites%\Links\Customize Links.url
• %Favorites%\Links\Free Hotmail.url
• %Favorites%\Links\Windows Marketplace.url
• %Favorites%\Links\Windows Media.url
• %Favorites%\Links\Windows.url
• %User Profile%\MSHist012013061320130614\index.dat
• %User Temp%\58e0ef.mst
• %User Temp%\AdobeARM.log
• %User Temp%\AdobeSFX.log
• %User Temp%\ASPNETSetup_00000.log
• %User Temp%\ASPNETSetup_00001.log
• %User Temp%\ASPNETSetup_00002.log
• %User Temp%\dd_depcheck_NETFX_EXP_35.txt
• %User Temp%\dd_dotnetfx35error.txt
• %User Temp%\dd_dotnetfx35install.txt
• %User Temp%\dd_dotNetFx40_Full_x86_x64_decompression_log.txt
• %User Temp%\dd_netfx20UI7F16.txt
• %User Temp%\dd_MSXML6_MSI0686.txt
• %User Temp%\dd_RGB9RAST_x86.msi0683.txt
• %User Temp%\dd_vcredistUI3CAA.txt
• %User Temp%\dd_vcredistUI7C21.txt
• %User Temp%\dd_wcf_CA_smci_20111017_044900_062.txt
• %User Temp%\dd_wcf_retCA29BA.txt
• %User Temp%\dd_WIC.txt
• %User Temp%\dd_vcredistMSI3CAA.txt
• %User Temp%\dd_XPS.txt
• %User Temp%\dd_vcredistMSI7C21.txt
• %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578.html
• %User Temp%\dd_NET_Framework35_MSI07B9.txt
• %User Temp%\uxeventlog.txt
• %User Temp%\vminst.log_20111016_212239_Failed.log
• %User Temp%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20111020_000954642.html
• %User Temp%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20111020_000954642-MSI_vc_red.msi.txt
• %User Temp%\vminst.log_20130313_012352_Failed.log
• %User Temp%\vminst.log_20130313_012028.log
• %User Temp%\WSFF8.tmp
• %User Temp%\WSFF9.tmp
• %User Profile%\My Music\Sample Music.lnk
• %User Profile%\My Pictures\Sample Pictures.lnk
• %User Temp%\vmmsi.log_20130313_012352_Failed.log
• %Start Menu%\Programs\Internet Explorer.lnk
• %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578-MSI_netfx_Extended_x86.msi.txt
• %Start Menu%\Programs\Outlook Express.lnk
• %Start Menu%\Programs\Accessories\Address Book.lnk
• %Start Menu%\Programs\Administrative Tools\desktop.ini
• %Desktop%\_HELP_INSTRUCTION.TXT