TROJ_CDOWN.A

マルウェアは、悪意あるWebサイトからユーザが誤ってダウンロードすることにより、コンピュータに侵入します。

侵入方法

マルウェアは、悪意あるWebサイトからユーザが誤ってダウンロードすることにより、コンピュータに侵入します。

インストール

マルウェアは、感染したコンピュータ内に以下のように自身のコピーを作成します。

• %User Profile%\{random characters}.exe

(註：%User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞" です。)

マルウェアは、以下の通常のプロセスにスレッドを組み込みます。

• SVCHOST.EXE

自動実行方法

マルウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKCU\Software\Microsoft\
Windows\CurrentVersion\Run
{random characters} = %User Profile%\{random characters}.exe

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

• {BLOCKED}p.com
• {BLOCKED}l.com
• {BLOCKED}995.com
• {BLOCKED}endlease.com
• {BLOCKED}t.com
• {BLOCKED}ternet.com
• {BLOCKED}dsl.de
• {BLOCKED}e.it
• {BLOCKED}eam.net
• amazon.com
• {BLOCKED}l.com.com
• {BLOCKED}venue.com
• {BLOCKED}ney.com
• {BLOCKED}tfurniture.com
• {BLOCKED}bendcable.com
• {BLOCKED}i.net
• {BLOCKED}ilders.com
• {BLOCKED}world.com
• bumbleandbumble.com
• {BLOCKED}ynx.com
• {BLOCKED}d.net
• {BLOCKED}il.com
• {BLOCKED}-systems.com
• {BLOCKED}ytel.net
• {BLOCKED}l.rr.com
• {BLOCKED}r.net
• {BLOCKED}ll.org
• {BLOCKED}nsys.com
• {BLOCKED}s.com
• {BLOCKED}d.com.ar
• {BLOCKED}ville.com
• {BLOCKED}ic.com
• {BLOCKED}.net.nz
• {BLOCKED}h.edu
• cnet.com
• {BLOCKED}t.net
• {BLOCKED}eclub.com
• colorado.edu
• comcast.com
• {BLOCKED}p.com
• {BLOCKED}tions-etc.net
• {BLOCKED}ton.edu
• {BLOCKED}aths.net
• {BLOCKED}t.dk
• {BLOCKED}a.com
• {BLOCKED}te.com
• {BLOCKED}r.bg
• {BLOCKED}iz.com
• {BLOCKED}l.com
• {BLOCKED}h.com
• {BLOCKED}d.jp
• earthlink.net
• {BLOCKED}m.net
• {BLOCKED}sn.com
• {BLOCKED}mail.com
• {BLOCKED}l.cl
• {BLOCKED}ille.net
• {BLOCKED}c.edu
• {BLOCKED}.co.jp
• {BLOCKED}e.com
• {BLOCKED}t.net
• {BLOCKED}m.dk
• {BLOCKED}inriver.net
• {BLOCKED}crossing.com
• {BLOCKED}r.com
• {BLOCKED}yboard.com
• {BLOCKED}ippo.com
• {BLOCKED}i.rr.com
• health.com
• {BLOCKED}ail.com
• {BLOCKED}do-this.com
• {BLOCKED}sville.net
• {BLOCKED}e.com
• {BLOCKED}il.com
• {BLOCKED}p.net
• {BLOCKED}c.com
• hustler.com
• {BLOCKED}a.{BLOCKED}m.net
• {BLOCKED}a.pl
• {BLOCKED}l.it
• {BLOCKED}s.com.au
• {BLOCKED}lth.org
• {BLOCKED}o.net
• {BLOCKED}u.edu
• {BLOCKED}g.net
• {BLOCKED}ing.edu
• {BLOCKED}y.net
• {BLOCKED}a.com
• {BLOCKED}wnecollege.com
• {BLOCKED}w.com
• {BLOCKED}a.com
• {BLOCKED}o.it
• {BLOCKED}e.net
• {BLOCKED}e.com
• {BLOCKED}ish.com
• {BLOCKED}d.com
• mail.com
• {BLOCKED}ell.com
• {BLOCKED}t.com
• {BLOCKED}a.com
• {BLOCKED}i.com
• {BLOCKED}o.com
• {BLOCKED}s.com
• {BLOCKED}tors.com
• msn.com
• mtv.com
• {BLOCKED}t.com
• {BLOCKED}e.net.au
• {BLOCKED}kdf.com
• {BLOCKED}u.edu
• {BLOCKED}.com
• {BLOCKED}d.org
• {BLOCKED}.ie
• {BLOCKED}ine.net
• {BLOCKED}cay.{BLOCKED}o.bz
• {BLOCKED}n.com
• {BLOCKED}.{BLOCKED}or.com
• {BLOCKED}ech.com
• {BLOCKED}a.com
• {BLOCKED}inmitsubishi.com
• {BLOCKED}online.com.au
• {BLOCKED}w.com
• {BLOCKED}t.lu
• {BLOCKED}r.com
• {BLOCKED}ds.edu
• {BLOCKED}c.com
• {BLOCKED}ner.com
• {BLOCKED}k.com
• {BLOCKED}e.com
• {BLOCKED}ine.de
• {BLOCKED}sports.com
• sky.com
• {BLOCKED}t.be
• {BLOCKED}sol.dk
• {BLOCKED}y.se
• {BLOCKED}d.com
• {BLOCKED}u.edu
• {BLOCKED}et.net
• {BLOCKED}obal.net
• {BLOCKED}m.net
• {BLOCKED}ne.de
• {BLOCKED}lk.net
• {BLOCKED}.uwa.edu.au
• {BLOCKED}r.com
• {BLOCKED}t.com
• {BLOCKED}imcute.com
• {BLOCKED}t.org
• {BLOCKED}i.it
• {BLOCKED}nott.com
• uncc.edu
• {BLOCKED}et.com
• {BLOCKED}efreaks.com
• {BLOCKED}e.com
• verizonwireless.com
• {BLOCKED}t.com.mx
• {BLOCKED}w.com
• vodafone.com
• {BLOCKED}ne.nl
• {BLOCKED}tream.com
• {BLOCKED}a.fr
• {BLOCKED}y.cz
• {BLOCKED}d.com
• {BLOCKED}n.com
• {BLOCKED}ream.net
• {BLOCKED}olutions.net
• {BLOCKED}net.co.nz
• {BLOCKED}etatt.net
• {BLOCKED}nline.co.uk
• yahoo.com.tw
• yahoo.dk
• yahoo.hk
• {BLOCKED}nebox.com