Ransom_WALTRIX.YUYALJ
Windows
![](/vinfo/imgFiles/JPlegend.jpg)
マルウェアタイプ:
トロイの木馬型
破壊活動の有無:
なし
暗号化:
感染報告の有無 :
はい
概要
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
詳細
侵入方法
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
他のシステム変更
マルウェアは、以下のファイルを改変します。
- %Application Data%\Microsoft\Media Player\CurrentDatabase_59R.wmdb
- %Temporary Internet Files%\Content.IE5\desktop.ini
- %Temporary Internet Files%\desktop.ini
- %Start Menu%\Programs\Accessories\Accessibility\desktop.ini
- %Start Menu%\Programs\Accessories\Entertainment\desktop.ini
- %Start Menu%\Programs\Accessories\desktop.ini
- %User Startup%\desktop.ini
- %Start Menu%\Programs\desktop.ini
- %Start Menu%\desktop.ini
- %User Profile%\Templates\amipro.sam
- %User Profile%\Templates\excel.xls
- %User Profile%\Templates\excel4.xls
- %User Profile%\Templates\powerpnt.ppt
- %User Profile%\Templates\sndrec.wav
- %User Profile%\Templates\winword.doc
- %User Profile%\Templates\winword2.doc
- %User Profile%\Templates\wordpfct.wpd
- %User Profile%\Templates\wordpfct.wpg
- %User Profile%\ntuser.ini
(註:%Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\<ユーザ名>\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\<ユーザ名>\AppData\Roaming" です。.. %Temporary Internet Files%フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\<ユーザ名>\Local Settings\Temporary Internet Files"、Windows Vista および 7 の場合、"C:\Users\<ユーザ名>\AppData\Local\Microsoft\Windows\Temporary Internet Files" です。. %Start Menu%フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Windows\Start Menu" または "C:\Documents and Settings\<ユーザ名>\Start Menu"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\<ユーザ名>\AppData\Roaming\Microsoft\Windows\Start Menu" です。.. %User Startup%フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\<ユーザ名>\Start Menu\Programs\Startup" 、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、" C:\Users\<ユーザ名>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" です。.. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\<ユーザ名>"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\<ユーザ名>" です。.)
作成活動
マルウェアは、以下のファイルを作成します。
- %User Temp%\README.TXT
- %User Temp%\README.HTML
- %User Temp%\PAB.KEY
- %User Temp%\README.BMP
- %User Profile%\RSA\MachineKeys
- %Desktop%.ini
- %User Profile%\Quick Launch\README.txt
- %User Profile%\Quick Launch\README.html
- %User Profile%\Quick Launch\README.bmp
- %User Profile%\Internet Explorer\brndlog.txt
- %User Profile%\Internet Explorer\README.txt
- %User Profile%\Internet Explorer\README.html
- %User Profile%\Internet Explorer\README.bmp
- %User Profile%\Application Data\README.txt
- %User Profile%\Application Data\README.html
- %User Profile%\Application Data\README.bmp
- %User Profile%\Cookies\wilbert@atdmt[2].txt
- %User Profile%\Cookies\wilbert@bing[2].txt
- %User Profile%\Cookies\wilbert@c.atdmt[2].txt
- %User Profile%\Cookies\wilbert@c.msn[2].txt
- %User Profile%\Cookies\wilbert@doubleclick[1].txt
- %User Profile%\Cookies\wilbert@microsoft[1].txt
- %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt
- %User Profile%\Cookies\wilbert@msn[2].txt
- %User Profile%\Cookies\wilbert@scorecardresearch[2].txt
- %User Profile%\Cookies\wilbert@www.bing[2].txt
- %User Profile%\Cookies\wilbert@www.msn[1].txt
- %User Profile%\Cookies\README.txt
- %User Profile%\Cookies\README.html
- %User Profile%\Cookies\README.bmp
- %Favorites%\README.txt
- %Favorites%\README.html
- %Favorites%\README.bmp
- %Application Data%\Microsoft\Media Player\README.txt
- %Application Data%\Microsoft\Media Player\README.html
- %Application Data%\Microsoft\Media Player\README.bmp
- %Application Data%\Microsoft\Wallpaper1.bmp
- %Application Data%\Microsoft\README.txt
- %Application Data%\Microsoft\README.html
- %Application Data%\Microsoft\README.bmp
- %User Profile%\History.IE5\README.txt
- %User Profile%\History.IE5\README.html
- %User Profile%\History.IE5\README.bmp
- %User Profile%\History\README.txt
- %User Profile%\History\README.html
- %User Profile%\History\README.bmp
- %User Temp%\dd_depcheck_NETFX_EXP_35.txt
- %User Temp%\dd_dotnetfx35error.txt
- %User Temp%\dd_dotnetfx35install.txt
- %User Temp%\dd_dotNetFx40_Full_x86_x64_decompression_log.txt
- %User Temp%\dd_MSXML6_MSI0686.txt
- %User Temp%\dd_netfx20MSI7F16.txt
- %User Temp%\dd_netfx20UI7F16.txt
- %User Temp%\dd_NET_Framework20_Setup06A7.txt
- %User Temp%\dd_NET_Framework30_Setup0775.txt
- %User Temp%\dd_NET_Framework35_MSI07B9.txt
- %User Temp%\dd_RGB9RAST_x86.msi0683.txt
- %User Temp%\dd_vcredistMSI3CAA.txt
- %User Temp%\dd_vcredistMSI7C21.txt
- %User Temp%\dd_vcredistUI3CAA.txt
- %User Temp%\dd_vcredistUI7C21.txt
- %User Temp%\dd_wcf_CA_smci_20111017_044900_062.txt
- %User Temp%\dd_wcf_retCA29BA.txt
- %User Temp%\dd_WIC.txt
- %User Temp%\dd_XPS.txt
- %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578-MSI_netfx_Core_x86.msi.txt
- %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578-MSI_netfx_Extended_x86.msi.txt
- %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578.html
- %User Temp%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20111020_000954642-MSI_vc_red.msi.txt
- %User Temp%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20111020_000954642.html
- %User Temp%\uxeventlog.txt
- %User Temp%\WSFF8.tmp
- %User Temp%\WSFF9.tmp
- %User Temp%\README.txt
- %User Temp%\README.html
- %User Temp%\README.bmp
- %Temporary Internet Files%\Content.IE5\09RWHJQN\1d56986ff895d82941fb9faf08c76f[1].css
- %Temporary Internet Files%\Content.IE5\09RWHJQN\4[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\53CAC6A10B6248682CF221B24A92[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\5c5d9b9cb6c19bcac7f82d676b488b[1].css
- %Temporary Internet Files%\Content.IE5\09RWHJQN\8213D9F75AD098D48F237D6CCC29F8[1].jpg
- %Temporary Internet Files%\Content.IE5\09RWHJQN\836390dd7004a00c9b21db33678d84[1].png
- %Temporary Internet Files%\Content.IE5\09RWHJQN\adchoices_gif2[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\ADSAdClient31[1].htm
- %Temporary Internet Files%\Content.IE5\09RWHJQN\ADSAdClient31[2].htm
- %Temporary Internet Files%\Content.IE5\09RWHJQN\BA1FA617D2822CCF20CF2239452095[1].jpg
- %Temporary Internet Files%\Content.IE5\09RWHJQN\bottom_left3[1].png
- %Temporary Internet Files%\Content.IE5\09RWHJQN\bottom_right3[1].png
- %Temporary Internet Files%\Content.IE5\09RWHJQN\box02[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\c57bc2a7d38843d7c4aa8028fc9f82[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\D2543C851E4AE4B1DB2DE3B1562DB[1].jpg
- %Temporary Internet Files%\Content.IE5\09RWHJQN\desktop.ini
- %Temporary Internet Files%\Content.IE5\09RWHJQN\msn[1].htm
- %Temporary Internet Files%\Content.IE5\09RWHJQN\top_left3[1].png
- %Temporary Internet Files%\Content.IE5\09RWHJQN\README.txt
- %Temporary Internet Files%\Content.IE5\09RWHJQN\README.html
- %Temporary Internet Files%\Content.IE5\09RWHJQN\README.bmp
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\0000000001_000000000000000017246[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\15A727F1384E33C33F18A135D9710[1].jpg
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\5280118e68aedbc5821d17132a5340[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\8adae8665171049ce4960396c72c86[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\923334461022280076d968be269386[1].png
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\9FFCFB0D17D6A8FD7C27416ED0DB[1].jpg
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\ADSAdClient31[1].htm
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\BA0EAC3FA44E01BE67D7651C9E60[1].jpg
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\box04[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\box08[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\cc36ca69630adc1a2052edc7351a47[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\desktop.ini
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\header00b[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\primedns[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\primedns[2].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\sck[1].htm
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\table_bottom3[1].png
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\README.txt
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\README.html
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\README.bmp
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\147[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\1db850e671ac9a39751a1482909ea6[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\614595fba50d96389708a4135776e4[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\617475cf39bf6f5c0bd6ecb985335c[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\9E82BCBB661C2665F77225A5DCC867[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\ADSAdClient31[1].htm
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\ADSAdClient31[2].htm
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\background[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\box06[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\CDAB2F44A1591D2B308C20C6C15375[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\desktop.ini
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\FD4957C9FB46179035C1C4F6407F10[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\GRedirect[2].aspx
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\msnhomepagehistory[1].aspx
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\primedns[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\primedns[2].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\primedns[3].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\table_right3[1].png
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\top_right3[1].png
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\README.txt
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\README.html
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\README.bmp
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\290e7f0b12fa8a201581c74c1ae75a[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\300x250_45914_4crocsl[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\37BA92E210D341BFDBF4126422A3D2[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\4[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\72541472A285479CAB60A1F736581[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\844DD2D2B4733FAE13849F794A7BD8[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\9b61bd1a420364db439350bebaac19[1].css
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\A5EE7088EC167F676F626203E7371[1].png
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\AB7F4D56A6421622DF40E72BA32B[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\ADSAdClient31[1].htm
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\BCEE3611B4F81EDE9240922336F1[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\BING_websearch_2[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\conditionalbanners[1].htm
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\D8F68391953F21ECC405DCBA92D39[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\desktop.ini
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\F7D0CF254A92D3932EDCF252CA5AB4[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\footer00[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\qsonhs[1].aspx
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\sck[1].htm
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\table_left3[1].png
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\table_top3[1].png
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\README.txt
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\README.html
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\README.bmp
- %Temporary Internet Files%\Content.IE5\README.txt
- %Temporary Internet Files%\Content.IE5\README.html
- %Temporary Internet Files%\Content.IE5\README.bmp
- %Temporary Internet Files%\README.txt
- %Temporary Internet Files%\README.html
- %Temporary Internet Files%\README.bmp
- %User Profile%\Local Settings\README.txt
- %User Profile%\Local Settings\README.html
- %User Profile%\Local Settings\README.bmp
- %User Profile%\My Music\README.txt
- %User Profile%\My Music\README.html
- %User Profile%\My Music\README.bmp
- %User Profile%\My Pictures\README.txt
- %User Profile%\My Pictures\README.html
- %User Profile%\My Pictures\README.bmp
- %User Profile%\My Documents\README.txt
- %User Profile%\My Documents\README.html
- %User Profile%\My Documents\README.bmp
- %User Profile%\Recent\README.txt
- %User Profile%\Recent\README.html
- %User Profile%\Recent\README.bmp
- %User Profile%\SendTo\README.txt
- %User Profile%\SendTo\README.html
- %User Profile%\SendTo\README.bmp
- %Start Menu%\Programs\Accessories\Accessibility\README.txt
- %Start Menu%\Programs\Accessories\Accessibility\README.html
- %Start Menu%\Programs\Accessories\Accessibility\README.bmp
- %Start Menu%\Programs\Accessories\Entertainment\README.txt
- %Start Menu%\Programs\Accessories\Entertainment\README.html
- %Start Menu%\Programs\Accessories\Entertainment\README.bmp
- %Start Menu%\Programs\Accessories\README.txt
- %Start Menu%\Programs\Accessories\README.html
- %Start Menu%\Programs\Accessories\README.bmp
- %Start Menu%\Programs\Administrative Tools\desktop.ini
- %Start Menu%\Programs\Administrative Tools\README.txt
- %Start Menu%\Programs\Administrative Tools\README.html
- %Start Menu%\Programs\Administrative Tools\README.bmp
- %User Startup%\README.txt
- %User Startup%\README.html
- %User Startup%\README.bmp
- %Start Menu%\Programs\README.txt
- %Start Menu%\Programs\README.html
- %Start Menu%\Programs\README.bmp
- %Start Menu%\README.txt
- %Start Menu%\README.html
- %Start Menu%\README.bmp
- %User Profile%\Templates\README.txt
- %User Profile%\Templates\README.html
- %User Profile%\Templates\README.bmp
- %User Profile%\README.txt
- %User Profile%\README.html
- %User Profile%\README.bmp
- %Start Menu%\Programs\README.txt.lnk
- %Start Menu%\Programs\README.html.lnk
- %Start Menu%\Programs\README.bmp.lnk
- pdlonulzed
- %Desktop%\README.txt
- %Desktop%\README.html
- %Desktop%\README.bmp
その他
マルウェアは、以下の不正なWebサイトにアクセスします。
- {BLOCKED}.131.147
このウイルス情報は、自動解析システムにより作成されました。
対応方法
手順 1
Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。
手順 2
以下のファイルを検索し削除します。
- %User Temp%\README.TXT
- %User Temp%\README.HTML
- %User Temp%\PAB.KEY
- %User Temp%\README.BMP
- %User Profile%\RSA\MachineKeys
- %Desktop%.ini
- %User Profile%\Quick Launch\README.txt
- %User Profile%\Quick Launch\README.html
- %User Profile%\Quick Launch\README.bmp
- %User Profile%\Internet Explorer\brndlog.txt
- %User Profile%\Internet Explorer\README.txt
- %User Profile%\Internet Explorer\README.html
- %User Profile%\Internet Explorer\README.bmp
- %User Profile%\Application Data\README.txt
- %User Profile%\Application Data\README.html
- %User Profile%\Application Data\README.bmp
- %User Profile%\Cookies\wilbert@atdmt[2].txt
- %User Profile%\Cookies\wilbert@bing[2].txt
- %User Profile%\Cookies\wilbert@c.atdmt[2].txt
- %User Profile%\Cookies\wilbert@c.msn[2].txt
- %User Profile%\Cookies\wilbert@doubleclick[1].txt
- %User Profile%\Cookies\wilbert@microsoft[1].txt
- %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt
- %User Profile%\Cookies\wilbert@msn[2].txt
- %User Profile%\Cookies\wilbert@scorecardresearch[2].txt
- %User Profile%\Cookies\wilbert@www.bing[2].txt
- %User Profile%\Cookies\wilbert@www.msn[1].txt
- %User Profile%\Cookies\README.txt
- %User Profile%\Cookies\README.html
- %User Profile%\Cookies\README.bmp
- %Favorites%\README.txt
- %Favorites%\README.html
- %Favorites%\README.bmp
- %Application Data%\Microsoft\Media Player\README.txt
- %Application Data%\Microsoft\Media Player\README.html
- %Application Data%\Microsoft\Media Player\README.bmp
- %Application Data%\Microsoft\Wallpaper1.bmp
- %Application Data%\Microsoft\README.txt
- %Application Data%\Microsoft\README.html
- %Application Data%\Microsoft\README.bmp
- %User Profile%\History.IE5\README.txt
- %User Profile%\History.IE5\README.html
- %User Profile%\History.IE5\README.bmp
- %User Profile%\History\README.txt
- %User Profile%\History\README.html
- %User Profile%\History\README.bmp
- %User Temp%\dd_depcheck_NETFX_EXP_35.txt
- %User Temp%\dd_dotnetfx35error.txt
- %User Temp%\dd_dotnetfx35install.txt
- %User Temp%\dd_dotNetFx40_Full_x86_x64_decompression_log.txt
- %User Temp%\dd_MSXML6_MSI0686.txt
- %User Temp%\dd_netfx20MSI7F16.txt
- %User Temp%\dd_netfx20UI7F16.txt
- %User Temp%\dd_NET_Framework20_Setup06A7.txt
- %User Temp%\dd_NET_Framework30_Setup0775.txt
- %User Temp%\dd_NET_Framework35_MSI07B9.txt
- %User Temp%\dd_RGB9RAST_x86.msi0683.txt
- %User Temp%\dd_vcredistMSI3CAA.txt
- %User Temp%\dd_vcredistMSI7C21.txt
- %User Temp%\dd_vcredistUI3CAA.txt
- %User Temp%\dd_vcredistUI7C21.txt
- %User Temp%\dd_wcf_CA_smci_20111017_044900_062.txt
- %User Temp%\dd_wcf_retCA29BA.txt
- %User Temp%\dd_WIC.txt
- %User Temp%\dd_XPS.txt
- %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578-MSI_netfx_Core_x86.msi.txt
- %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578-MSI_netfx_Extended_x86.msi.txt
- %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578.html
- %User Temp%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20111020_000954642-MSI_vc_red.msi.txt
- %User Temp%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20111020_000954642.html
- %User Temp%\uxeventlog.txt
- %User Temp%\WSFF8.tmp
- %User Temp%\WSFF9.tmp
- %User Temp%\README.txt
- %User Temp%\README.html
- %User Temp%\README.bmp
- %Temporary Internet Files%\Content.IE5\09RWHJQN\1d56986ff895d82941fb9faf08c76f[1].css
- %Temporary Internet Files%\Content.IE5\09RWHJQN\4[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\53CAC6A10B6248682CF221B24A92[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\5c5d9b9cb6c19bcac7f82d676b488b[1].css
- %Temporary Internet Files%\Content.IE5\09RWHJQN\8213D9F75AD098D48F237D6CCC29F8[1].jpg
- %Temporary Internet Files%\Content.IE5\09RWHJQN\836390dd7004a00c9b21db33678d84[1].png
- %Temporary Internet Files%\Content.IE5\09RWHJQN\adchoices_gif2[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\ADSAdClient31[1].htm
- %Temporary Internet Files%\Content.IE5\09RWHJQN\ADSAdClient31[2].htm
- %Temporary Internet Files%\Content.IE5\09RWHJQN\BA1FA617D2822CCF20CF2239452095[1].jpg
- %Temporary Internet Files%\Content.IE5\09RWHJQN\bottom_left3[1].png
- %Temporary Internet Files%\Content.IE5\09RWHJQN\bottom_right3[1].png
- %Temporary Internet Files%\Content.IE5\09RWHJQN\box02[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\c57bc2a7d38843d7c4aa8028fc9f82[1].gif
- %Temporary Internet Files%\Content.IE5\09RWHJQN\D2543C851E4AE4B1DB2DE3B1562DB[1].jpg
- %Temporary Internet Files%\Content.IE5\09RWHJQN\desktop.ini
- %Temporary Internet Files%\Content.IE5\09RWHJQN\msn[1].htm
- %Temporary Internet Files%\Content.IE5\09RWHJQN\top_left3[1].png
- %Temporary Internet Files%\Content.IE5\09RWHJQN\README.txt
- %Temporary Internet Files%\Content.IE5\09RWHJQN\README.html
- %Temporary Internet Files%\Content.IE5\09RWHJQN\README.bmp
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\0000000001_000000000000000017246[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\15A727F1384E33C33F18A135D9710[1].jpg
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\5280118e68aedbc5821d17132a5340[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\8adae8665171049ce4960396c72c86[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\923334461022280076d968be269386[1].png
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\9FFCFB0D17D6A8FD7C27416ED0DB[1].jpg
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\ADSAdClient31[1].htm
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\BA0EAC3FA44E01BE67D7651C9E60[1].jpg
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\box04[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\box08[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\cc36ca69630adc1a2052edc7351a47[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\desktop.ini
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\header00b[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\primedns[1].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\primedns[2].gif
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\sck[1].htm
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\table_bottom3[1].png
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\README.txt
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\README.html
- %Temporary Internet Files%\Content.IE5\BVLBNMKH\README.bmp
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\147[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\1db850e671ac9a39751a1482909ea6[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\614595fba50d96389708a4135776e4[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\617475cf39bf6f5c0bd6ecb985335c[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\9E82BCBB661C2665F77225A5DCC867[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\ADSAdClient31[1].htm
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\ADSAdClient31[2].htm
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\background[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\box06[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\CDAB2F44A1591D2B308C20C6C15375[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\desktop.ini
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\FD4957C9FB46179035C1C4F6407F10[1].jpg
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\GRedirect[2].aspx
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\msnhomepagehistory[1].aspx
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\primedns[1].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\primedns[2].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\primedns[3].gif
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\table_right3[1].png
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\top_right3[1].png
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\README.txt
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\README.html
- %Temporary Internet Files%\Content.IE5\ZDGZNKA5\README.bmp
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\290e7f0b12fa8a201581c74c1ae75a[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\300x250_45914_4crocsl[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\37BA92E210D341BFDBF4126422A3D2[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\4[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\72541472A285479CAB60A1F736581[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\844DD2D2B4733FAE13849F794A7BD8[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\9b61bd1a420364db439350bebaac19[1].css
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\A5EE7088EC167F676F626203E7371[1].png
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\AB7F4D56A6421622DF40E72BA32B[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\ADSAdClient31[1].htm
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\BCEE3611B4F81EDE9240922336F1[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\BING_websearch_2[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\conditionalbanners[1].htm
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\D8F68391953F21ECC405DCBA92D39[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\desktop.ini
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\F7D0CF254A92D3932EDCF252CA5AB4[1].jpg
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\footer00[1].gif
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\qsonhs[1].aspx
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\sck[1].htm
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\table_left3[1].png
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\table_top3[1].png
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\README.txt
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\README.html
- %Temporary Internet Files%\Content.IE5\ZSGKJKO6\README.bmp
- %Temporary Internet Files%\Content.IE5\README.txt
- %Temporary Internet Files%\Content.IE5\README.html
- %Temporary Internet Files%\Content.IE5\README.bmp
- %Temporary Internet Files%\README.txt
- %Temporary Internet Files%\README.html
- %Temporary Internet Files%\README.bmp
- %User Profile%\Local Settings\README.txt
- %User Profile%\Local Settings\README.html
- %User Profile%\Local Settings\README.bmp
- %User Profile%\My Music\README.txt
- %User Profile%\My Music\README.html
- %User Profile%\My Music\README.bmp
- %User Profile%\My Pictures\README.txt
- %User Profile%\My Pictures\README.html
- %User Profile%\My Pictures\README.bmp
- %User Profile%\My Documents\README.txt
- %User Profile%\My Documents\README.html
- %User Profile%\My Documents\README.bmp
- %User Profile%\Recent\README.txt
- %User Profile%\Recent\README.html
- %User Profile%\Recent\README.bmp
- %User Profile%\SendTo\README.txt
- %User Profile%\SendTo\README.html
- %User Profile%\SendTo\README.bmp
- %Start Menu%\Programs\Accessories\Accessibility\README.txt
- %Start Menu%\Programs\Accessories\Accessibility\README.html
- %Start Menu%\Programs\Accessories\Accessibility\README.bmp
- %Start Menu%\Programs\Accessories\Entertainment\README.txt
- %Start Menu%\Programs\Accessories\Entertainment\README.html
- %Start Menu%\Programs\Accessories\Entertainment\README.bmp
- %Start Menu%\Programs\Accessories\README.txt
- %Start Menu%\Programs\Accessories\README.html
- %Start Menu%\Programs\Accessories\README.bmp
- %Start Menu%\Programs\Administrative Tools\desktop.ini
- %Start Menu%\Programs\Administrative Tools\README.txt
- %Start Menu%\Programs\Administrative Tools\README.html
- %Start Menu%\Programs\Administrative Tools\README.bmp
- %User Startup%\README.txt
- %User Startup%\README.html
- %User Startup%\README.bmp
- %Start Menu%\Programs\README.txt
- %Start Menu%\Programs\README.html
- %Start Menu%\Programs\README.bmp
- %Start Menu%\README.txt
- %Start Menu%\README.html
- %Start Menu%\README.bmp
- %User Profile%\Templates\README.txt
- %User Profile%\Templates\README.html
- %User Profile%\Templates\README.bmp
- %User Profile%\README.txt
- %User Profile%\README.html
- %User Profile%\README.bmp
- %Start Menu%\Programs\README.txt.lnk
- %Start Menu%\Programs\README.html.lnk
- %Start Menu%\Programs\README.bmp.lnk
- pdlonulzed
- %Desktop%\README.txt
- %Desktop%\README.html
- %Desktop%\README.bmp
手順 3
最新のバージョン(エンジン、パターンファイル)を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「Ransom_WALTRIX.YUYALJ」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。
手順 4
以下のファイルをバックアップを用いて修復します。マイクロソフト製品に関連したファイルのみに修復されます。このマルウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。
- %Application Data%\Microsoft\Media Player\CurrentDatabase_59R.wmdb
- %Temporary Internet Files%\Content.IE5\desktop.ini
- %Temporary Internet Files%\desktop.ini
- %Start Menu%\Programs\Accessories\Accessibility\desktop.ini
- %Start Menu%\Programs\Accessories\Entertainment\desktop.ini
- %Start Menu%\Programs\Accessories\desktop.ini
- %User Startup%\desktop.ini
- %Start Menu%\Programs\desktop.ini
- %Start Menu%\desktop.ini
- %User Profile%\Templates\amipro.sam
- %User Profile%\Templates\excel.xls
- %User Profile%\Templates\excel4.xls
- %User Profile%\Templates\powerpnt.ppt
- %User Profile%\Templates\sndrec.wav
- %User Profile%\Templates\winword.doc
- %User Profile%\Templates\winword2.doc
- %User Profile%\Templates\wordpfct.wpd
- %User Profile%\Templates\wordpfct.wpg
- %User Profile%\ntuser.ini
ご利用はいかがでしたか? アンケートにご協力ください