TROJ_REMHEAD.KCL
Trojan:Win32/Remhead!gmb, Trojan:Win32/Remhead!gmb (Microsoft); Trojan.ADH.2 (Symantec); Trojan.Win32.Genome.alzag (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Worm/Generic.BSFZ.dropper (AVG)
Windows
マルウェアタイプ:
トロイの木馬型
破壊活動の有無:
なし
暗号化:
感染報告の有無 :
はい
概要
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
詳細
侵入方法
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
インストール
マルウェアは、以下のフォルダを作成します。
- %User Temp%\mia9.tmp
- %User Temp%\mia9.tmp\data
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode
- %User Temp%\mia9.tmp\data\OFFLINE
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\unicode
- %User Temp%\mia9.tmp\data\mDotNet.dll
- %User Temp%\mia9.tmp\data\mMSI.dll
- %User Temp%\mia9.tmp\data\mWinRun.dll
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6
- %System Root%\DOCUME~1
- %System Root%\DOCUME~1\Wilbert
- %User Profile%\LOCALS~1
- %System Root%\Documents and Settings\Wilbert
- %User Profile%\Spooler
- %User Profile%\Spooler\Data
- %User Profile%\Data\Cookie
- %Application Data%\PackageAware
- %User Temp%\mia1
- %User Profile%\Application Data\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}
- %User Profile%\CryptnetUrlCache\MetaData
- %User Profile%\Microsoft\CryptnetUrlCache
- %User Profile%\CryptnetUrlCache\Content
- %User Profile%\Application Data\Stardock
- %User Profile%\Stardock\Fences
- %User Profile%\Fences\TroubleshootingLog
(註：%User Temp%フォルダは、ユーザの一時フォルダで、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。.. %System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞" です。.. %Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming" です。.)
他のシステム変更
マルウェアは、以下のファイルを削除します。
- %User Temp%\mia9.tmp
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.lan
(註：%User Temp%フォルダは、ユーザの一時フォルダで、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。.. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞" です。.)
マルウェアは、以下のフォルダを削除します。
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\__ad
(註：%User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞" です。.)
マルウェアは、以下のレジストリキーを追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
HKEY_LOCAL_MACHINE\SOFTWARE\MimarSinan\
InstallAware\Ident.Cache\{10CD364B-FFCC-48BE-B469-B9622A033075}
HKEY_CURRENT_USER\Software\Stardock\
Fences
HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\
Misc\Fences
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\v2.0.50727\NGenService\
Roots\C:/Program Files/Stardock/Fences/Fences.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\v2.0.50727\NGenService\
Roots\C:/Program Files/Stardock/Fences/Fences.exe\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1984DD45-52CF-49cd-AB77-18F378FEA264}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1984DD45-52CF-49cd-AB77-18F378FEA264}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
*\shellex\ContextMenuHandlers\
DesktopDockShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
*\shellex\ContextMenuHandlers\
FencesShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Directory\shellex\ContextMenuHandlers\
DesktopDockShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Directory\shellex\ContextMenuHandlers\
FencesShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Directory\Background\shellex\
ContextMenuHandlers\DesktopDockShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Directory\Background\shellex\
ContextMenuHandlers\FencesShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Folder\shellex\ContextMenuHandlers\
DesktopDockShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Folder\shellex\ContextMenuHandlers\
FencesShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
lnkfile\shellex\ContextMenuHandlers\
DesktopDockShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
lnkfile\shellex\ContextMenuHandlers\
FencesShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
InternetShortcut\shellex\ContextMenuHandlers\
DesktopDockShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
InternetShortcut\shellex\ContextMenuHandlers\
FencesShellExt
HKEY_CLASSES_ROOT\IE.AssocFile.URL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
IE.AssocFile.URL\shellex
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
IE.AssocFile.URL\shellex\ContextMenuHandlers
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
IE.AssocFile.URL\shellex\ContextMenuHandlers\
DesktopDockShellExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
IE.AssocFile.URL\shellex\ContextMenuHandlers\
FencesShellExt
マルウェアは、以下のレジストリ値を追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{10CD364B-FFCC-48BE-B469-B9622A033075}
UninstallString = "%User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
DisplayIcon = "%User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
DisplayName = "Fences"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
ModifyPath = "%User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
Publisher = "Stardock Corporation"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
Contact = "Stardock Corporation"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
HelpLink = "http://www.{BLOCKED}pfences.com"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
URLUpdateInfo = "http://www.{BLOCKED}pfences.com"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
Comments = "All rights reserved"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fences
InstallLocation = "%Program Files%\Stardock\Fences"
HKEY_CURRENT_USER\Software\Stardock\
Fences
DateInstalled = "2/25/2015 9:04:40 PM"
HKEY_CURRENT_USER\Software\Stardock\
Fences
InstalledViaImpulse = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\
Misc\Fences
Exe = "Fences.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\
Misc\Fences
Path = "%Program Files%\Stardock\Fences"
HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\
Misc\Fences
Version = "1.00.000"
HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\
Misc\Fences
Updated = "2/25/2015 9:04:59 PM"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\v2.0.50727\NGenService\
Roots
WorkPending = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\v2.0.50727\NGenService\
Roots\C:/Program Files/Stardock/Fences/Fences.exe\0
Status = "2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\v2.0.50727\NGenService\
Roots\C:/Program Files/Stardock/Fences/Fences.exe\0
Scenario = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\v2.0.50727\NGenService\
Roots\C:/Program Files/Stardock/Fences/Fences.exe
Status = "3"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\v2.0.50727\NGenService\
Roots\C:/Program Files/Stardock/Fences/Fences.exe\0
RuntimeVersion = "v2.0.50727"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\v2.0.50727\NGenService\
Roots\C:/Program Files/Stardock/Fences/Fences.exe\0
ImageList = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1984DD45-52CF-49cd-AB77-18F378FEA264}
DisableProcessIsolation = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1984DD45-52CF-49cd-AB77-18F378FEA264}\InprocServer32
ThreadingModel = "Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Shell Extensions\
Approved
{1984DD45-52CF-49cd-AB77-18F378FEA264} = "FencesShlExt"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Shell Extensions\
Approved
{1984DD45-52CF-49cd-AB77-18F378FEA264} {000214e8-0000-0000-c000-000000000046} 0x401 = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
SharedTaskScheduler
{1984DD45-52CF-49cd-AB77-18F378FEA264} = "FencesShellExt"
マルウェアは、以下のレジストリ値を変更します。
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Desktop\Components
GeneralFlags = "0"
(註：変更前の上記レジストリ値は、「1」となります。)
作成活動
マルウェアは、以下のファイルを作成します。
- %User Temp%\fences_public.exe
- %User Temp%\mol2.exe
- %User Temp%\mia9.tmp\data\Fences.msi
- %User Temp%\mia9.tmp\Fences.msi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\instmsi.msi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\instmsi.msi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\instmsi.msi
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\eula.txt
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\Readme.txt
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C\segoeui.ttf
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C\segoeuib.ttf
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C\segoeuii.ttf
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C\segoeuiz.ttf
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\Fences.exe
- %User Temp%\mia9.tmp\Fences.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msiexec.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msiinst.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\unicode\update.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\cabinet.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\DesktopDock.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\DesktopDock64.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\FencesMenu.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\FencesMenu64.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\imagehlp.dll
- %User Temp%\mia9.tmp\data\mDotNet.dll\mDotNetExec.dll
- %User Temp%\mia9.tmp\data\mMSI.dll\mMSIExec.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msihnd.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msimsg.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msisip.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msls31.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\mspatcha.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\mWinRunExec.dll
- %User Temp%\mia9.tmp\data\mWinRun.dll\mWinRunExec.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\riched20.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\sdbapi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\shfolder.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\usp10.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\VistaBridgeLibrary.dll
- %User Temp%\mia9.tmp\mia.lib
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.cat
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\Bottom.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\BottomRight.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\BottomRightCorner.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\Inital0.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\Inital1.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\LeftAndRight.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\Right.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\RightDouble.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\TopBottom.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\TopLeftAndRight.fencelayout
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.inf
- %User Temp%\mia9.tmp\Fences.res
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimain.sdb
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimain.sdb
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msimain.sdb
- %User Temp%\mia9.tmp\data\{10CD364B-FFCC-48BE-B469-B9622A033075}
- __tmp_rar_sfx_access_check_173671
- detoured.dll
- dfrag.exe
- dfragsnap.dll
- HpColorLaser.lnk
- auditusr.exe
- %User Temp%\lang.loc
- %User Temp%\mia.tmp
- %User Temp%\mia1\componentstree.dfm
- %User Temp%\mia1\destination.dfm
- %User Temp%\mia1\finish.dfm
- %User Temp%\mia1\finish.dfm.miaf
- %User Temp%\mia1\icon.ico
- %User Temp%\mia1\index.htm
- %User Temp%\mia1\license.rtf
- %User Temp%\mia1\licensecheck.dfm
- %User Temp%\mia1\licensecheck.dfm.miaf
- %User Temp%\mia1\maintenance.dfm
- %User Temp%\mia1\prereq.dfm
- %User Temp%\mia1\prereq.dfm.miaf
- %User Temp%\mia1\prereqdn.dfm
- %User Temp%\mia1\progress.dfm
- %User Temp%\mia1\progress.dfm.miaf
- %User Temp%\mia1\progressprereq.dfm
- %User Temp%\mia1\readme.dfm
- %User Temp%\mia1\readme.dfm.miaf
- %User Temp%\mia1\readme.rtf
- %User Temp%\mia1\registration.dfm
- %User Temp%\mia1\registration.dfm.miaf
- %User Temp%\mia1\registrationwithserial.dfm
- %User Temp%\mia1\registrationwithserial.dfm.miaf
- %User Temp%\mia1\setuptype.dfm
- %User Temp%\mia1\startinstallation.dfm
- %User Temp%\mia1\startmenu.dfm
- %User Temp%\mia1\startmenu.dfm.miaf
- %User Temp%\mia1\welcome.dfm
- %User Temp%\mia1\wizard.dfm
- %User Temp%\mia1\mDotNetExec.dll
- %User Temp%\mia1\mMSIExec.dll
- %User Temp%\mia1\mWinRunExec.dll
- %User Temp%\mia1\componentstree.dfm.miaf
- %User Temp%\mia1\destination.dfm.miaf
- %User Temp%\mia1\maintenance.dfm.miaf
- %User Temp%\mia1\prereqdn.dfm.miaf
- %User Temp%\mia1\progressprereq.dfm.miaf
- %User Temp%\mia1\setuptype.dfm.miaf
- %User Temp%\mia1\startinstallation.dfm.miaf
- %User Temp%\mia1\welcome.dfm.miaf
- %User Temp%\mia1\wizard.dfm.miaf
- %User Temp%\{10CD364B-FFCC-48BE-B469-B9622A033075}
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.dat
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.par
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.lnk
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\instance.dat
- %User Profile%\MetaData\B69D763EB21649DA26F20618312DEE70
- %User Profile%\Content\B69D763EB21649DA26F20618312DEE70
- %Desktop%\Customize Fences.lnk
- %Windows%\Microsoft.NET\Framework\v2.0.50727\ngen.lock
- %Windows%\Microsoft.NET\Framework\v4.0.30319\ngenserviceclientlock.dat
- %Windows%\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat
- %User Temp%\mia1\Fences.msp
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.msi
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.res
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\mia.lib
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\setup.bmp
(註：%User Temp%フォルダは、ユーザの一時フォルダで、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。.. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞" です。.. %Desktop%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Desktop"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\Desktop" です。.. %Windows%フォルダは、Windowsが利用するフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows" です。.)
その他
マルウェアは、以下の不正なWebサイトにアクセスします。
- {BLOCKED}5.83.2
このウイルス情報は、自動解析システムにより作成されました。
対応方法
手順 1
Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。
手順 2
不明なレジストリ値を削除します。
警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- Fences
- In HKEY_LOCAL_MACHINE\SOFTWARE\MimarSinan\InstallAware\Ident.Cache
- {10CD364B-FFCC-48BE-B469-B9622A033075}
- In HKEY_CURRENT_USER\Software\Stardock
- Fences
- In HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\Misc
- Fences
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots
- C:/Program Files/Stardock/Fences/Fences.exe
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Stardock/Fences/Fences.exe
- 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {1984DD45-52CF-49cd-AB77-18F378FEA264}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1984DD45-52CF-49cd-AB77-18F378FEA264}
- InprocServer32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers
- DesktopDockShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers
- FencesShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers
- DesktopDockShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers
- FencesShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers
- DesktopDockShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers
- FencesShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers
- DesktopDockShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers
- FencesShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers
- DesktopDockShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers
- FencesShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\ContextMenuHandlers
- DesktopDockShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\ContextMenuHandlers
- FencesShellExt
- In HKEY_CLASSES_ROOT
- IE.AssocFile.URL
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL
- shellex
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\shellex
- ContextMenuHandlers
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers
- DesktopDockShellExt
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers
- FencesShellExt
手順 3
このレジストリ値を削除します。
警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{10CD364B-FFCC-48BE-B469-B9622A033075}
- UninstallString = "%User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- DisplayIcon = "%User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- DisplayName = "Fences"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- ModifyPath = "%User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- Publisher = "Stardock Corporation"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- Contact = "Stardock Corporation"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- HelpLink = "http://www.{BLOCKED}pfences.com"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- URLUpdateInfo = "http://www.{BLOCKED}pfences.com"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- Comments = "All rights reserved"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fences
- InstallLocation = "%Program Files%\Stardock\Fences"
- In HKEY_CURRENT_USER\Software\Stardock\Fences
- DateInstalled = "2/25/2015 9:04:40 PM"
- In HKEY_CURRENT_USER\Software\Stardock\Fences
- InstalledViaImpulse = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\Misc\Fences
- Exe = "Fences.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\Misc\Fences
- Path = "%Program Files%\Stardock\Fences"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\Misc\Fences
- Version = "1.00.000"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Stardock\Misc\Fences
- Updated = "2/25/2015 9:04:59 PM"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots
- WorkPending = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Stardock/Fences/Fences.exe\0
- Status = "2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Stardock/Fences/Fences.exe\0
- Scenario = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Stardock/Fences/Fences.exe
- Status = "3"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Stardock/Fences/Fences.exe\0
- RuntimeVersion = "v2.0.50727"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Stardock/Fences/Fences.exe\0
- ImageList = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1984DD45-52CF-49cd-AB77-18F378FEA264}
- DisableProcessIsolation = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1984DD45-52CF-49cd-AB77-18F378FEA264}\InprocServer32
- ThreadingModel = "Apartment"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
- {1984DD45-52CF-49cd-AB77-18F378FEA264} = "FencesShlExt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
- {1984DD45-52CF-49cd-AB77-18F378FEA264} {000214e8-0000-0000-c000-000000000046} 0x401 = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
- {1984DD45-52CF-49cd-AB77-18F378FEA264} = "FencesShellExt"
手順 4
変更されたレジストリ値を修正します。
警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
事前に意図的に対象の設定を変更していた場合は、意図するオリジナルの設定に戻してください。変更する値が分からない場合は、システム管理者にお尋ねいただき、レジストリの編集はお客様の責任として行なって頂くようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components
- From: GeneralFlags = "0"
To: GeneralFlags = ""1""
- From: GeneralFlags = "0"
手順 5
以下のファイルを検索し削除します。
- %User Temp%\fences_public.exe
- %User Temp%\mol2.exe
- %User Temp%\mia9.tmp\data\Fences.msi
- %User Temp%\mia9.tmp\Fences.msi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\instmsi.msi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\instmsi.msi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\instmsi.msi
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\eula.txt
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\Readme.txt
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C\segoeui.ttf
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C\segoeuib.ttf
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C\segoeuii.ttf
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C\segoeuiz.ttf
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\Fences.exe
- %User Temp%\mia9.tmp\Fences.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msiexec.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msiinst.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\unicode\update.exe
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\cabinet.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\DesktopDock.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\DesktopDock64.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\FencesMenu.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\FencesMenu64.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\imagehlp.dll
- %User Temp%\mia9.tmp\data\mDotNet.dll\mDotNetExec.dll
- %User Temp%\mia9.tmp\data\mMSI.dll\mMSIExec.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msihnd.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msimsg.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msisip.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msls31.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\mspatcha.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\mWinRunExec.dll
- %User Temp%\mia9.tmp\data\mWinRun.dll\mWinRunExec.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\riched20.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\sdbapi.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\shfolder.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\usp10.dll
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334\VistaBridgeLibrary.dll
- %User Temp%\mia9.tmp\mia.lib
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.cat
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\Bottom.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\BottomRight.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\BottomRightCorner.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\Inital0.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\Inital1.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\LeftAndRight.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\Right.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\RightDouble.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\TopBottom.fencelayout
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6\TopLeftAndRight.fencelayout
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.inf
- %User Temp%\mia9.tmp\Fences.res
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimain.sdb
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimain.sdb
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi\msimain.sdb
- %User Temp%\mia9.tmp\data\{10CD364B-FFCC-48BE-B469-B9622A033075}
- __tmp_rar_sfx_access_check_173671
- detoured.dll
- dfrag.exe
- dfragsnap.dll
- HpColorLaser.lnk
- auditusr.exe
- %User Temp%\lang.loc
- %User Temp%\mia.tmp
- %User Temp%\mia1\componentstree.dfm
- %User Temp%\mia1\destination.dfm
- %User Temp%\mia1\finish.dfm
- %User Temp%\mia1\finish.dfm.miaf
- %User Temp%\mia1\icon.ico
- %User Temp%\mia1\index.htm
- %User Temp%\mia1\license.rtf
- %User Temp%\mia1\licensecheck.dfm
- %User Temp%\mia1\licensecheck.dfm.miaf
- %User Temp%\mia1\maintenance.dfm
- %User Temp%\mia1\prereq.dfm
- %User Temp%\mia1\prereq.dfm.miaf
- %User Temp%\mia1\prereqdn.dfm
- %User Temp%\mia1\progress.dfm
- %User Temp%\mia1\progress.dfm.miaf
- %User Temp%\mia1\progressprereq.dfm
- %User Temp%\mia1\readme.dfm
- %User Temp%\mia1\readme.dfm.miaf
- %User Temp%\mia1\readme.rtf
- %User Temp%\mia1\registration.dfm
- %User Temp%\mia1\registration.dfm.miaf
- %User Temp%\mia1\registrationwithserial.dfm
- %User Temp%\mia1\registrationwithserial.dfm.miaf
- %User Temp%\mia1\setuptype.dfm
- %User Temp%\mia1\startinstallation.dfm
- %User Temp%\mia1\startmenu.dfm
- %User Temp%\mia1\startmenu.dfm.miaf
- %User Temp%\mia1\welcome.dfm
- %User Temp%\mia1\wizard.dfm
- %User Temp%\mia1\mDotNetExec.dll
- %User Temp%\mia1\mMSIExec.dll
- %User Temp%\mia1\mWinRunExec.dll
- %User Temp%\mia1\componentstree.dfm.miaf
- %User Temp%\mia1\destination.dfm.miaf
- %User Temp%\mia1\maintenance.dfm.miaf
- %User Temp%\mia1\prereqdn.dfm.miaf
- %User Temp%\mia1\progressprereq.dfm.miaf
- %User Temp%\mia1\setuptype.dfm.miaf
- %User Temp%\mia1\startinstallation.dfm.miaf
- %User Temp%\mia1\welcome.dfm.miaf
- %User Temp%\mia1\wizard.dfm.miaf
- %User Temp%\{10CD364B-FFCC-48BE-B469-B9622A033075}
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.dat
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.par
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.lnk
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\instance.dat
- %User Profile%\MetaData\B69D763EB21649DA26F20618312DEE70
- %User Profile%\Content\B69D763EB21649DA26F20618312DEE70
- %Desktop%\Customize Fences.lnk
- %Windows%\Microsoft.NET\Framework\v2.0.50727\ngen.lock
- %Windows%\Microsoft.NET\Framework\v4.0.30319\ngenserviceclientlock.dat
- %Windows%\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat
- %User Temp%\mia1\Fences.msp
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.msi
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.res
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\mia.lib
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\setup.bmp
手順 6
以下のフォルダを検索し削除します。
- %User Temp%\mia9.tmp
- %User Temp%\mia9.tmp\data
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\ansi
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode
- %User Temp%\mia9.tmp\data\OFFLINE
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85
- %User Temp%\mia9.tmp\data\OFFLINE\E28DAC85\5F26D334
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E
- %User Temp%\mia9.tmp\data\OFFLINE\E583CD7E\B258534C
- %User Temp%\mia9.tmp\data\Microsoft Windows Installer 3.0\mWinRun.dll\unicode
- %User Temp%\mia9.tmp\data\mDotNet.dll
- %User Temp%\mia9.tmp\data\mMSI.dll
- %User Temp%\mia9.tmp\data\mWinRun.dll
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1
- %User Temp%\mia9.tmp\data\OFFLINE\F234E6A1\D3E9A3D6
- %System Root%\DOCUME~1
- %System Root%\DOCUME~1\Wilbert
- %User Profile%\LOCALS~1
- %System Root%\Documents and Settings\Wilbert
- %User Profile%\Spooler
- %User Profile%\Spooler\Data
- %User Profile%\Data\Cookie
- %Application Data%\PackageAware
- %User Temp%\mia1
- %User Profile%\Application Data\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}
- %User Profile%\CryptnetUrlCache\MetaData
- %User Profile%\Microsoft\CryptnetUrlCache
- %User Profile%\CryptnetUrlCache\Content
- %User Profile%\Application Data\Stardock
- %User Profile%\Stardock\Fences
- %User Profile%\Fences\TroubleshootingLog
手順 7
最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「TROJ_REMHEAD.KCL」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。
手順 8
以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。
- %User Temp%\mia9.tmp
- %User Profile%\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.lan
ご利用はいかがでしたか？ アンケートにご協力ください