TROJ_AGENT.SMFG
Downloader.a!df (McAfee); Downloader (Symantec); Trojan-Downloader.Win32.Agent.fgkv (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Trojan.Generic.KD.47794 (FSecure)
Windows 2000, Windows XP, Windows Server 2003
マルウェアタイプ:
トロイの木馬型
破壊活動の有無:
なし
暗号化:
感染報告の有無 :
はい
概要
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
詳細
侵入方法
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
インストール
マルウェアは、以下のフォルダを作成します。
- %System Root%\DOCUME~1
- %System Root%\DOCUME~1\ADMINI~1
- %User Profile%\LOCALS~1
- %User Temp%\nsq2.tmp
- %Program Files%\uusee
- %Program Files%\Common Files\uusee
- %Program Files%\Common Files\uusee\review
(註:%System Root%フォルダは、標準設定では "C:" です。また、オペレーティングシステムが存在する場所です。. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\<ユーザ名>"、Windows Vista および 7 の場合、"C:\Users\<ユーザ名>" です。. %User Temp%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 2000、XP および Server 2003 の場合、"C:\Documents and Settings\<ユーザー名>\Local Settings\Temp"、Windows Vista および 7 の場合、"C:\Users\<ユーザ名>\AppData\Local\Temp" です。. %Program Files%フォルダは、Windows 2000、Server 2003、XP (32ビット)、通常 Vista (32ビット) および 7 (32ビット) の場合、通常 "C:\Program Files"、Windows XP (64ビット)、Vista (64ビット) および 7 (64ビット) の場合、通常 "C:\Program Files (x86)" です。)
他のシステム変更
マルウェアは、以下のファイルを削除します。
- %User Profile%\setup\UUSee_vip1_Setup_2010.exe
- %User Temp%\nsl1.tmp
- %User Temp%\nsq2.tmp
(註:%User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\<ユーザ名>"、Windows Vista および 7 の場合、"C:\Users\<ユーザ名>" です。. %User Temp%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 2000、XP および Server 2003 の場合、"C:\Documents and Settings\<ユーザー名>\Local Settings\Temp"、Windows Vista および 7 の場合、"C:\Users\<ユーザ名>\AppData\Local\Temp" です。)
マルウェアは、以下のレジストリキーを追加します。
HKEY_LOCAL_MACHINE\Software\uusee\
UUPlayer_2008
HKEY_LOCAL_MACHINE\Software\uusee\
UUPlayer_2010
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}\1.0\
FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}\1.0\
0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}\1.0\
0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}\1.0\
HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{263BE21D-D834-4971-8097-1F5954995C18}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{263BE21D-D834-4971-8097-1F5954995C18}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{263BE21D-D834-4971-8097-1F5954995C18}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{263BE21D-D834-4971-8097-1F5954995C18}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}\TypeLib
HKEY_CLASSES_ROOT\CLSID\{1185448F-CD61-4FD0-A728-F62407D354AA}
HKEY_CLASSES_ROOT\CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
HKEY_CLASSES_ROOT\UUWEBPLAYER.UUWebPlayerCtrl.1
HKEY_CLASSES_ROOT\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\
{F070A0E8-B213-47E4-8991-252AC82EE6A1}
HKEY_CLASSES_ROOT\Media Type\Extensions\
.ucf
HKEY_CLASSES_ROOT\CLSID\{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
HKEY_CLASSES_ROOT\CLSID\{17413BA0-0160-4C1F-BA66-679436BCA89B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{17413BA0-0160-4C1F-BA66-679436BCA89B}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{17413BA0-0160-4C1F-BA66-679436BCA89B}
HKEY_CLASSES_ROOT\CLSID\{91AD598F-876B-4790-8857-ABFE5ED6159F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{91AD598F-876B-4790-8857-ABFE5ED6159F}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{A2113517-E452-43A3-977D-28BA30D5E389}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A2113517-E452-43A3-977D-28BA30D5E389}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{0583926D-C114-4605-8DF3-770402F50E61}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0583926D-C114-4605-8DF3-770402F50E61}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{91AD598F-876B-4790-8857-ABFE5ED6159F}
HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{A2113517-E452-43A3-977D-28BA30D5E389}
HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{0583926D-C114-4605-8DF3-770402F50E61}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0\
FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0\
0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0\
0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0\
HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}\TypeLib
HKEY_CLASSES_ROOT\CLSID\{945E37E3-156F-4757-AA1F-CBA338DDFBE9}
HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\
CoreAVC Pro 2.x
HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\
CoreAVC Pro
HKEY_CLASSES_ROOT\UPLAYER.UPlayerCtrl.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}\1.0\
FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}\1.0\
0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}\1.0\
0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}\1.0\
HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{B9587E96-9349-4F58-A7D5-77E53811BDFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{B9587E96-9349-4F58-A7D5-77E53811BDFD}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{B9587E96-9349-4F58-A7D5-77E53811BDFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{B9587E96-9349-4F58-A7D5-77E53811BDFD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E9475D64-4461-4A22-BD58-132AF1D7D565}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E9475D64-4461-4A22-BD58-132AF1D7D565}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E9475D64-4461-4A22-BD58-132AF1D7D565}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E9475D64-4461-4A22-BD58-132AF1D7D565}\TypeLib
HKEY_CLASSES_ROOT\CLSID\{28966B43-B5D0-4694-9E79-F5B4099F02D4}
マルウェアは、以下のレジストリ値を追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\uusee\
UUPlayer_2008
InstallName = "uusee_vip1_setup_2010.exe*010000000000000@{malware file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\uusee\
UUPlayer_2010
InstallName = "uusee_vip1_setup_2010.exe*010000000000000@{malware file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{263BE21D-D834-4971-8097-1F5954995C18}\TypeLib
Version = "1.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}\TypeLib
Version = "1.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1185448F-CD61-4FD0-A728-F62407D354AA}
InprocServer32 = "%Program Files%\COMMON~1\uusee\UUWEBP~1.OCX"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
UUWEBPLAYER.UUWebPlayerCtrl.1
CLSID = "{6C348EAC-3600-45D3-B477-DFEDDFB78472}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
ProgID = "UUWEBPLAYER.UUWebPlayerCtrl.1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
InprocServer32 = "%Program Files%\COMMON~1\uusee\UUWEBP~1.OCX"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
ToolboxBitmap32 = "%Program Files%\COMMON~1\uusee\UUWEBP~1.OCX, 1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
MiscStatus = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
MiscStatus\1 = "131473"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
TypeLib = "{34A24C1F-46A0-46B1-92C9-210132D85E60}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
Version = "1.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}\InprocServer32
ThreadingModel = "Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{F070A0E8-B213-47E4-8991-252AC82EE6A1}
Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{F070A0E8-B213-47E4-8991-252AC82EE6A1}
0 = "0,4,,46494c45"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Media Type\Extensions\.ucf
Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Media Type\Extensions\.ucf
Media Type = "{E436EB83-524F-11CE-9F53-0020AF0BA770}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Media Type\Extensions\.ucf
Subtype = "{F070A0E8-B213-47E4-8991-252AC82EE6A1}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}\InprocServer32
ThreadingModel = "Both"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
FriendlyName = "UUSEE DeMultiplexer"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
CLSID = "{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
FilterData = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{17413BA0-0160-4C1F-BA66-679436BCA89B}\InprocServer32
ThreadingModel = "Both"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{17413BA0-0160-4C1F-BA66-679436BCA89B}
FriendlyName = "UUSEE Source"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{17413BA0-0160-4C1F-BA66-679436BCA89B}
CLSID = "{17413BA0-0160-4C1F-BA66-679436BCA89B}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{17413BA0-0160-4C1F-BA66-679436BCA89B}
FilterData = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{91AD598F-876B-4790-8857-ABFE5ED6159F}\InprocServer32
ThreadingModel = "Both"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}\InprocServer32
ThreadingModel = "Both"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A2113517-E452-43A3-977D-28BA30D5E389}\InprocServer32
ThreadingModel = "Both"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0583926D-C114-4605-8DF3-770402F50E61}\InprocServer32
ThreadingModel = "Both"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{91AD598F-876B-4790-8857-ABFE5ED6159F}
FriendlyName = "RealMedia Splitter"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{91AD598F-876B-4790-8857-ABFE5ED6159F}
CLSID = "{91AD598F-876B-4790-8857-ABFE5ED6159F}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{91AD598F-876B-4790-8857-ABFE5ED6159F}
FilterData = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
FriendlyName = "RealMedia Source"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
CLSID = "{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
FilterData = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{A2113517-E452-43A3-977D-28BA30D5E389}
FriendlyName = "RealVideo Decoder"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{A2113517-E452-43A3-977D-28BA30D5E389}
CLSID = "{A2113517-E452-43A3-977D-28BA30D5E389}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{A2113517-E452-43A3-977D-28BA30D5E389}
FilterData = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{0583926D-C114-4605-8DF3-770402F50E61}
FriendlyName = "RealAudio Decoder"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{0583926D-C114-4605-8DF3-770402F50E61}
CLSID = "{0583926D-C114-4605-8DF3-770402F50E61}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\
{0583926D-C114-4605-8DF3-770402F50E61}
FilterData = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}\TypeLib
Version = "1.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}\TypeLib
Version = "1.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{945E37E3-156F-4757-AA1F-CBA338DDFBE9}
InprocServer32 = "%Program Files%\COMMON~1\uusee\SEEPLA~1.OCX"
HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\
CoreAVC Pro 2.x
User = "ryomikai33@gundam.eu"
HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\
CoreAVC Pro 2.x
Serial = "3TDVPV-XCNFDT-VAZVCD-17JVPC-16DCLL"
HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\
CoreAVC Pro
User = "Registered User"
HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\
CoreAVC Pro
Serial = "IQIKB-6F7KD-CORE-IXRJW-IGUHC"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
UPLAYER.UPlayerCtrl.1
CLSID = "{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
ProgID = "UPLAYER.UPlayerCtrl.1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
InprocServer32 = "%Program Files%\COMMON~1\uusee\SEEPLA~1.OCX"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
ToolboxBitmap32 = "%Program Files%\COMMON~1\uusee\SEEPLA~1.OCX, 1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
MiscStatus = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
MiscStatus\1 = "131473"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
TypeLib = "{754EFA30-C752-4F45-8890-6250A53FD512}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
Version = "1.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}\InprocServer32
ThreadingModel = "Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{B9587E96-9349-4F58-A7D5-77E53811BDFD}\TypeLib
Version = "1.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E9475D64-4461-4A22-BD58-132AF1D7D565}\TypeLib
Version = "1.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{28966B43-B5D0-4694-9E79-F5B4099F02D4}
InprocServer32 = "%Program Files%\COMMON~1\uusee\UUPlayer.ocx"
マルウェアは、以下のレジストリキーを削除します。
HKEY_CURRENT_USER\Software\Microsoft\
Multimedia\ActiveMovie\Filter Cache
作成活動
マルウェアは、以下のファイルを作成します。
- %User Profile%\setup\app1.tmp
- %User Profile%\setup\app2.tmp
- %User Temp%\nsq2.tmp\System.dll
- %User Temp%\nsq2.tmp\FindProcDLL.dll
- %User Temp%\upercent.gif
- %User Temp%\nsq2.tmp\AnimGif.dll
- %System%\nsis_loader.dll
- %Program Files%\Common Files\uusee\UUWebPlayer.ocx
- %Program Files%\Common Files\uusee\kumidesktop.ico
- %Program Files%\Common Files\uusee\mp4demux.ax
- %Program Files%\Common Files\uusee\UFDeMux.ax
- %Program Files%\Common Files\uusee\UFSource.ax
- %Program Files%\Common Files\uusee\rmsp011.ax
- %Program Files%\Common Files\uusee\UUPlayer.ocx
- %Program Files%\Common Files\uusee\check_cmd.exe
- %Program Files%\Common Files\uusee\UUPlayer.exe
- %Program Files%\Common Files\uusee\download.dll
- %Program Files%\Common Files\uusee\videoAccDll.dll
- %Program Files%\Common Files\uusee\ENet.dll
- %Program Files%\Common Files\uusee\UUNet.dll
- %Program Files%\Common Files\uusee\updll.dll
- %Program Files%\Common Files\uusee\EnetDep.dll
- %Program Files%\Common Files\uusee\EnetDepNee.dll
- %Program Files%\Common Files\uusee\Microsoft.VC90.CRT.manifest
- %Program Files%\Common Files\uusee\msvcp90.dll
- %Program Files%\Common Files\uusee\msvcr90.dll
- %Program Files%\Common Files\uusee\CoCode.dll
- %Program Files%\Common Files\uusee\in_net.dll
- %Program Files%\Common Files\uusee\out_mmshttp.dll
- %Program Files%\Common Files\uusee\UUUpgrade.exe
- %Program Files%\Common Files\uusee\UUUpgrade.ocx
- %Program Files%\Common Files\uusee\UUUpgrade.dll
- %Program Files%\Common Files\uusee\Localserver.dll
- %Program Files%\Common Files\uusee\recommend.dll
- %Program Files%\Common Files\uusee\b_taobao.ico
- %Program Files%\Common Files\uusee\seeplayer.ocx
- %Program Files%\Common Files\uusee\trafficlight.dll
- %Program Files%\Common Files\uusee\UUSeeMediaCenter.exe
- %Program Files%\Common Files\uusee\npuuseep.dll
- %Program Files%\Common Files\uusee\MediaCenter.ini
- %Program Files%\Common Files\uusee\UUUpgrade.ini
- %Program Files%\Common Files\uusee\review\bf_bg.gif
- %Program Files%\Common Files\uusee\review\local.htm
- %Program Files%\Common Files\uusee\review\skin1_bufferbar.gif
- %Program Files%\Common Files\uusee\review\skin1_bufferbg0.gif
- %Program Files%\Common Files\uusee\review\skin1_bufferbg1.gif
- %Program Files%\Common Files\uusee\review\skin_fullscreen.gif
- %Program Files%\Common Files\uusee\review\skin_mute.gif
- %Program Files%\Common Files\uusee\review\skin_pause.gif
- %Program Files%\Common Files\uusee\review\skin_play.gif
- %Program Files%\Common Files\uusee\review\skin_qback.gif
- %Program Files%\Common Files\uusee\review\skin_qnext.gif
- %Program Files%\Common Files\uusee\review\skin_share.gif
- %Program Files%\Common Files\uusee\review\skin_stop.gif
- %Program Files%\Common Files\uusee\review\skin_volume.gif
- %Program Files%\Common Files\uusee\review\skin_volumebar.gif
- %Program Files%\Common Files\uusee\review\skin_volumebarbg.gif
- %Program Files%\Common Files\uusee\review\skin_volumebarbg2.gif
- %Program Files%\Common Files\uusee\uninst.exe
(註:%User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\<ユーザ名>"、Windows Vista および 7 の場合、"C:\Users\<ユーザ名>" です。. %User Temp%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 2000、XP および Server 2003 の場合、"C:\Documents and Settings\<ユーザー名>\Local Settings\Temp"、Windows Vista および 7 の場合、"C:\Users\<ユーザ名>\AppData\Local\Temp" です。. %System%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では "C:\Windows\System32" です。. %Program Files%フォルダは、Windows 2000、Server 2003、XP (32ビット)、通常 Vista (32ビット) および 7 (32ビット) の場合、通常 "C:\Program Files"、Windows XP (64ビット)、Vista (64ビット) および 7 (64ビット) の場合、通常 "C:\Program Files (x86)" です。)
その他
マルウェアは、以下の不正なWebサイトにアクセスします。
- http://download.{BLOCKED}e.com/pop2/vip1/UUSee_vip1_Setup_2010.exe
このウイルス情報は、自動解析システムにより作成されました。
対応方法
手順 1
Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。
手順 2
このレジストリキーを削除します。
警告:レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\Software\uusee
- UUPlayer_2008
- In HKEY_LOCAL_MACHINE\Software\uusee
- UUPlayer_2010
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
- {34A24C1F-46A0-46B1-92C9-210132D85E60}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}
- 1.0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}\1.0
- FLAGS
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}\1.0
- 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}\1.0\0
- win32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{34A24C1F-46A0-46B1-92C9-210132D85E60}\1.0
- HELPDIR
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {263BE21D-D834-4971-8097-1F5954995C18}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{263BE21D-D834-4971-8097-1F5954995C18}
- ProxyStubClsid
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{263BE21D-D834-4971-8097-1F5954995C18}
- ProxyStubClsid32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{263BE21D-D834-4971-8097-1F5954995C18}
- TypeLib
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}
- ProxyStubClsid
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}
- ProxyStubClsid32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}
- TypeLib
- In HKEY_CLASSES_ROOT\CLSID
- {1185448F-CD61-4FD0-A728-F62407D354AA}
- In HKEY_CLASSES_ROOT\CLSID
- {6C348EAC-3600-45D3-B477-DFEDDFB78472}
- In HKEY_CLASSES_ROOT
- UUWEBPLAYER.UUWebPlayerCtrl.1
- In HKEY_CLASSES_ROOT\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}
- {F070A0E8-B213-47E4-8991-252AC82EE6A1}
- In HKEY_CLASSES_ROOT\Media Type\Extensions
- .ucf
- In HKEY_CLASSES_ROOT\CLSID
- {48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
- InprocServer32
- In HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance
- {48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
- In HKEY_CLASSES_ROOT\CLSID
- {17413BA0-0160-4C1F-BA66-679436BCA89B}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17413BA0-0160-4C1F-BA66-679436BCA89B}
- InprocServer32
- In HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance
- {17413BA0-0160-4C1F-BA66-679436BCA89B}
- In HKEY_CLASSES_ROOT\CLSID
- {91AD598F-876B-4790-8857-ABFE5ED6159F}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91AD598F-876B-4790-8857-ABFE5ED6159F}
- InprocServer32
- In HKEY_CLASSES_ROOT\CLSID
- {E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
- InprocServer32
- In HKEY_CLASSES_ROOT\CLSID
- {A2113517-E452-43A3-977D-28BA30D5E389}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A2113517-E452-43A3-977D-28BA30D5E389}
- InprocServer32
- In HKEY_CLASSES_ROOT\CLSID
- {0583926D-C114-4605-8DF3-770402F50E61}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0583926D-C114-4605-8DF3-770402F50E61}
- InprocServer32
- In HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance
- {91AD598F-876B-4790-8857-ABFE5ED6159F}
- In HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance
- {E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
- In HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance
- {A2113517-E452-43A3-977D-28BA30D5E389}
- In HKEY_CLASSES_ROOT\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance
- {0583926D-C114-4605-8DF3-770402F50E61}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
- {754EFA30-C752-4F45-8890-6250A53FD512}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}
- 1.0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0
- FLAGS
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0
- 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0\0
- win32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{754EFA30-C752-4F45-8890-6250A53FD512}\1.0
- HELPDIR
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {770B88B4-DCD8-4857-8E82-62C650F58545}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}
- ProxyStubClsid
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}
- ProxyStubClsid32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}
- TypeLib
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}
- ProxyStubClsid
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}
- ProxyStubClsid32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}
- TypeLib
- In HKEY_CLASSES_ROOT\CLSID
- {945E37E3-156F-4757-AA1F-CBA338DDFBE9}
- In HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec
- CoreAVC Pro 2.x
- In HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec
- CoreAVC Pro
- In HKEY_CLASSES_ROOT
- UPLAYER.UPlayerCtrl.1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
- {41E77C38-9383-404C-BC49-EDF2AEA4E163}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}
- 1.0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}\1.0
- FLAGS
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}\1.0
- 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}\1.0\0
- win32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{41E77C38-9383-404C-BC49-EDF2AEA4E163}\1.0
- HELPDIR
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {B9587E96-9349-4F58-A7D5-77E53811BDFD}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B9587E96-9349-4F58-A7D5-77E53811BDFD}
- ProxyStubClsid
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B9587E96-9349-4F58-A7D5-77E53811BDFD}
- ProxyStubClsid32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B9587E96-9349-4F58-A7D5-77E53811BDFD}
- TypeLib
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {E9475D64-4461-4A22-BD58-132AF1D7D565}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9475D64-4461-4A22-BD58-132AF1D7D565}
- ProxyStubClsid
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9475D64-4461-4A22-BD58-132AF1D7D565}
- ProxyStubClsid32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9475D64-4461-4A22-BD58-132AF1D7D565}
- TypeLib
- In HKEY_CLASSES_ROOT\CLSID
- {28966B43-B5D0-4694-9E79-F5B4099F02D4}
手順 3
このレジストリ値を削除します。
警告:レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SOFTWARE\uusee\UUPlayer_2008
- InstallName = "uusee_vip1_setup_2010.exe*010000000000000@{malware file name}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\uusee\UUPlayer_2010
- InstallName = "uusee_vip1_setup_2010.exe*010000000000000@{malware file name}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{263BE21D-D834-4971-8097-1F5954995C18}\TypeLib
- Version = "1.0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}\TypeLib
- Version = "1.0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1185448F-CD61-4FD0-A728-F62407D354AA}
- InprocServer32 = "%Program Files%\COMMON~1\uusee\UUWEBP~1.OCX"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\UUWEBPLAYER.UUWebPlayerCtrl.1
- CLSID = "{6C348EAC-3600-45D3-B477-DFEDDFB78472}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
- ProgID = "UUWEBPLAYER.UUWebPlayerCtrl.1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
- InprocServer32 = "%Program Files%\COMMON~1\uusee\UUWEBP~1.OCX"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
- ToolboxBitmap32 = "%Program Files%\COMMON~1\uusee\UUWEBP~1.OCX, 1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
- MiscStatus = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
- MiscStatus\1 = "131473"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
- TypeLib = "{34A24C1F-46A0-46B1-92C9-210132D85E60}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}
- Version = "1.0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C348EAC-3600-45D3-B477-DFEDDFB78472}\InprocServer32
- ThreadingModel = "Apartment"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{F070A0E8-B213-47E4-8991-252AC82EE6A1}
- Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{F070A0E8-B213-47E4-8991-252AC82EE6A1}
- 0 = "0,4,,46494c45"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Media Type\Extensions\.ucf
- Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Media Type\Extensions\.ucf
- Media Type = "{E436EB83-524F-11CE-9F53-0020AF0BA770}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Media Type\Extensions\.ucf
- Subtype = "{F070A0E8-B213-47E4-8991-252AC82EE6A1}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}\InprocServer32
- ThreadingModel = "Both"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
- FriendlyName = "UUSEE DeMultiplexer"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
- CLSID = "{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
- FilterData = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17413BA0-0160-4C1F-BA66-679436BCA89B}\InprocServer32
- ThreadingModel = "Both"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{17413BA0-0160-4C1F-BA66-679436BCA89B}
- FriendlyName = "UUSEE Source"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{17413BA0-0160-4C1F-BA66-679436BCA89B}
- CLSID = "{17413BA0-0160-4C1F-BA66-679436BCA89B}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{17413BA0-0160-4C1F-BA66-679436BCA89B}
- FilterData = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91AD598F-876B-4790-8857-ABFE5ED6159F}\InprocServer32
- ThreadingModel = "Both"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}\InprocServer32
- ThreadingModel = "Both"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A2113517-E452-43A3-977D-28BA30D5E389}\InprocServer32
- ThreadingModel = "Both"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0583926D-C114-4605-8DF3-770402F50E61}\InprocServer32
- ThreadingModel = "Both"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{91AD598F-876B-4790-8857-ABFE5ED6159F}
- FriendlyName = "RealMedia Splitter"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{91AD598F-876B-4790-8857-ABFE5ED6159F}
- CLSID = "{91AD598F-876B-4790-8857-ABFE5ED6159F}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{91AD598F-876B-4790-8857-ABFE5ED6159F}
- FilterData = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
- FriendlyName = "RealMedia Source"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
- CLSID = "{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
- FilterData = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A2113517-E452-43A3-977D-28BA30D5E389}
- FriendlyName = "RealVideo Decoder"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A2113517-E452-43A3-977D-28BA30D5E389}
- CLSID = "{A2113517-E452-43A3-977D-28BA30D5E389}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A2113517-E452-43A3-977D-28BA30D5E389}
- FilterData = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{0583926D-C114-4605-8DF3-770402F50E61}
- FriendlyName = "RealAudio Decoder"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{0583926D-C114-4605-8DF3-770402F50E61}
- CLSID = "{0583926D-C114-4605-8DF3-770402F50E61}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{0583926D-C114-4605-8DF3-770402F50E61}
- FilterData = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{770B88B4-DCD8-4857-8E82-62C650F58545}\TypeLib
- Version = "1.0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}\TypeLib
- Version = "1.0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{945E37E3-156F-4757-AA1F-CBA338DDFBE9}
- InprocServer32 = "%Program Files%\COMMON~1\uusee\SEEPLA~1.OCX"
- In HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\CoreAVC Pro 2.x
- User = "ryomikai33@gundam.eu"
- In HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\CoreAVC Pro 2.x
- Serial = "3TDVPV-XCNFDT-VAZVCD-17JVPC-16DCLL"
- In HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\CoreAVC Pro
- User = "Registered User"
- In HKEY_LOCAL_MACHINE\SOFTWARE\CoreCodec\CoreAVC Pro
- Serial = "IQIKB-6F7KD-CORE-IXRJW-IGUHC"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\UPLAYER.UPlayerCtrl.1
- CLSID = "{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
- ProgID = "UPLAYER.UPlayerCtrl.1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
- InprocServer32 = "%Program Files%\COMMON~1\uusee\SEEPLA~1.OCX"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
- ToolboxBitmap32 = "%Program Files%\COMMON~1\uusee\SEEPLA~1.OCX, 1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
- MiscStatus = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
- MiscStatus\1 = "131473"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
- TypeLib = "{754EFA30-C752-4F45-8890-6250A53FD512}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
- Version = "1.0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}\InprocServer32
- ThreadingModel = "Apartment"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B9587E96-9349-4F58-A7D5-77E53811BDFD}\TypeLib
- Version = "1.0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9475D64-4461-4A22-BD58-132AF1D7D565}\TypeLib
- Version = "1.0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{28966B43-B5D0-4694-9E79-F5B4099F02D4}
- InprocServer32 = "%Program Files%\COMMON~1\uusee\UUPlayer.ocx"
手順 4
以下のファイルを検索し削除します。
- %User Profile%\setup\app1.tmp
- %User Profile%\setup\app2.tmp
- %User Temp%\nsq2.tmp\System.dll
- %User Temp%\nsq2.tmp\FindProcDLL.dll
- %User Temp%\upercent.gif
- %User Temp%\nsq2.tmp\AnimGif.dll
- %System%\nsis_loader.dll
- %Program Files%\Common Files\uusee\UUWebPlayer.ocx
- %Program Files%\Common Files\uusee\kumidesktop.ico
- %Program Files%\Common Files\uusee\mp4demux.ax
- %Program Files%\Common Files\uusee\UFDeMux.ax
- %Program Files%\Common Files\uusee\UFSource.ax
- %Program Files%\Common Files\uusee\rmsp011.ax
- %Program Files%\Common Files\uusee\UUPlayer.ocx
- %Program Files%\Common Files\uusee\check_cmd.exe
- %Program Files%\Common Files\uusee\UUPlayer.exe
- %Program Files%\Common Files\uusee\download.dll
- %Program Files%\Common Files\uusee\videoAccDll.dll
- %Program Files%\Common Files\uusee\ENet.dll
- %Program Files%\Common Files\uusee\UUNet.dll
- %Program Files%\Common Files\uusee\updll.dll
- %Program Files%\Common Files\uusee\EnetDep.dll
- %Program Files%\Common Files\uusee\EnetDepNee.dll
- %Program Files%\Common Files\uusee\Microsoft.VC90.CRT.manifest
- %Program Files%\Common Files\uusee\msvcp90.dll
- %Program Files%\Common Files\uusee\msvcr90.dll
- %Program Files%\Common Files\uusee\CoCode.dll
- %Program Files%\Common Files\uusee\in_net.dll
- %Program Files%\Common Files\uusee\out_mmshttp.dll
- %Program Files%\Common Files\uusee\UUUpgrade.exe
- %Program Files%\Common Files\uusee\UUUpgrade.ocx
- %Program Files%\Common Files\uusee\UUUpgrade.dll
- %Program Files%\Common Files\uusee\Localserver.dll
- %Program Files%\Common Files\uusee\recommend.dll
- %Program Files%\Common Files\uusee\b_taobao.ico
- %Program Files%\Common Files\uusee\seeplayer.ocx
- %Program Files%\Common Files\uusee\trafficlight.dll
- %Program Files%\Common Files\uusee\UUSeeMediaCenter.exe
- %Program Files%\Common Files\uusee\npuuseep.dll
- %Program Files%\Common Files\uusee\MediaCenter.ini
- %Program Files%\Common Files\uusee\UUUpgrade.ini
- %Program Files%\Common Files\uusee\review\bf_bg.gif
- %Program Files%\Common Files\uusee\review\local.htm
- %Program Files%\Common Files\uusee\review\skin1_bufferbar.gif
- %Program Files%\Common Files\uusee\review\skin1_bufferbg0.gif
- %Program Files%\Common Files\uusee\review\skin1_bufferbg1.gif
- %Program Files%\Common Files\uusee\review\skin_fullscreen.gif
- %Program Files%\Common Files\uusee\review\skin_mute.gif
- %Program Files%\Common Files\uusee\review\skin_pause.gif
- %Program Files%\Common Files\uusee\review\skin_play.gif
- %Program Files%\Common Files\uusee\review\skin_qback.gif
- %Program Files%\Common Files\uusee\review\skin_qnext.gif
- %Program Files%\Common Files\uusee\review\skin_share.gif
- %Program Files%\Common Files\uusee\review\skin_stop.gif
- %Program Files%\Common Files\uusee\review\skin_volume.gif
- %Program Files%\Common Files\uusee\review\skin_volumebar.gif
- %Program Files%\Common Files\uusee\review\skin_volumebarbg.gif
- %Program Files%\Common Files\uusee\review\skin_volumebarbg2.gif
- %Program Files%\Common Files\uusee\uninst.exe
手順 5
以下のフォルダを検索し削除します。
- %System Root%\DOCUME~1
- %System Root%\DOCUME~1\ADMINI~1
- %User Profile%\LOCALS~1
- %User Temp%\nsq2.tmp
- %Program Files%\uusee
- %Program Files%\Common Files\uusee
- %Program Files%\Common Files\uusee\review
手順 6
最新のバージョン(エンジン、パターンファイル)を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「TROJ_AGENT.SMFG」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。
手順 7
以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア/グレイウェア/スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。
- %User Profile%\setup\UUSee_vip1_Setup_2010.exe
- %User Temp%\nsl1.tmp
- %User Temp%\nsq2.tmp
手順 8
以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。
※註:マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。
- In HKEY_CURRENT_USER\Software\Microsoft\Multimedia\ActiveMovie
- Filter Cache
ご利用はいかがでしたか? アンケートにご協力ください