TROJ_YAKES.DUKNB
RDN/Generic.cf!a (McAfee); Downloader.Ponik (Symantec); Trojan.Win32.Yakes.klgd (Kaspersky); Troj/Kryptik-FF (Sophos); Trojan.Win32.Generic!BT (Sunbelt); Trojan horse Agent5.WVD (AVG)
Windows
マルウェアタイプ:
トロイの木馬型
破壊活動の有無:
なし
暗号化:
感染報告の有無 :
はい
概要
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
マルウェアは、実行後、自身を削除します。
詳細
侵入方法
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
インストール
マルウェアは、以下のフォルダを作成します。
- %Windows%\AppPatch\Custom
- %User Profile%\CryptnetUrlCache\MetaData
- %User Profile%\Microsoft\CryptnetUrlCache
- %User Profile%\CryptnetUrlCache\Content
(註：%Windows%フォルダは、Windowsが利用するフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows" です。.. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞" です。.)
他のシステム変更
マルウェアは、以下のレジストリキーを追加します。
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\explorer.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}
HKEY_CURRENT_USER\SOFTWARE\cxsw
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\opera.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\mozilla.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{344fc323-e820-4709-b0e9-a41dd23db924}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{344fc323-e820-4709-b0e9-a41dd23db924}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\chrome.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{63938229-2036-4820-b89e-d9a9bf62cf1d}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\iexplore.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\navigator.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\firefox.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\firef.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\myie.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\maxthon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{73112710-b137-4153-8cc6-7bde43f0e0c0}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\msmsgs.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{eeccdd9e-a118-4804-982b-0aa444c1ec70}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\avant.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{0f2a54c5-4bce-48ae-959f-010502eef6bd}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\lsass.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{57812750-a427-4319-84cd-256c99455794}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{57812750-a427-4319-84cd-256c99455794}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\thunderbird.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\thebat.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\outlook.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\epic.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{5b12c756-edb7-4be6-8735-ced0aea83ce9}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\msimn.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{0d3843c8-9a71-4037-8333-8afc9bec2180}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\seamonkey.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{6ae1d85d-33db-417e-915e-a54c53877a90}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{6ae1d85d-33db-417e-915e-a54c53877a90}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\iron.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\dragon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{010843db-076b-483f-b849-3e20540e94ed}.sdb
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{010843db-076b-483f-b849-3e20540e94ed}
マルウェアは、以下のレジストリ値を追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb
DisplayName = "explorer.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}
DatabasePath = "%Windows%\AppPatch\Custom\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}
DatabaseDescription = "explorer.exe"
HKEY_CURRENT_USER\Software
binaryImage32_0 = "{random values}"
HKEY_CURRENT_USER\Software
binaryImage32_1 = "{random values}"
HKEY_CURRENT_USER\Software
binaryImage32_2 = "{random values}"
HKEY_CURRENT_USER\Software
binaryImage32_3 = "{random values}"
HKEY_CURRENT_USER\Software
binaryImage32_4 = "{random values}"
HKEY_CURRENT_USER\Software
binaryImage32_5 = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb
DisplayName = "opera.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}
DatabasePath = "%Windows%\AppPatch\Custom\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}
DatabaseDescription = "opera.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{344fc323-e820-4709-b0e9-a41dd23db924}.sdb
DisplayName = "mozilla.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{344fc323-e820-4709-b0e9-a41dd23db924}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{344fc323-e820-4709-b0e9-a41dd23db924}
DatabasePath = "%Windows%\AppPatch\Custom\{344fc323-e820-4709-b0e9-a41dd23db924}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{344fc323-e820-4709-b0e9-a41dd23db924}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{344fc323-e820-4709-b0e9-a41dd23db924}
DatabaseDescription = "mozilla.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb
DisplayName = "chrome.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{63938229-2036-4820-b89e-d9a9bf62cf1d}
DatabasePath = "%Windows%\AppPatch\Custom\{63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{63938229-2036-4820-b89e-d9a9bf62cf1d}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{63938229-2036-4820-b89e-d9a9bf62cf1d}
DatabaseDescription = "chrome.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb
DisplayName = "iexplore.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}
DatabasePath = "%Windows%\AppPatch\Custom\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}
DatabaseDescription = "iexplore.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb
DisplayName = "navigator.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}
DatabasePath = "%Windows%\AppPatch\Custom\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}
DatabaseDescription = "navigator.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb
DisplayName = "firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}
DatabasePath = "%Windows%\AppPatch\Custom\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}
DatabaseDescription = "firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb
DisplayName = "firef.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}
DatabasePath = "%Windows%\AppPatch\Custom\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}
DatabaseDescription = "firef.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb
DisplayName = "myie.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}
DatabasePath = "%Windows%\AppPatch\Custom\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}
DatabaseDescription = "myie.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb
DisplayName = "maxthon.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{73112710-b137-4153-8cc6-7bde43f0e0c0}
DatabasePath = "%Windows%\AppPatch\Custom\{73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{73112710-b137-4153-8cc6-7bde43f0e0c0}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{73112710-b137-4153-8cc6-7bde43f0e0c0}
DatabaseDescription = "maxthon.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb
DisplayName = "msmsgs.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{eeccdd9e-a118-4804-982b-0aa444c1ec70}
DatabasePath = "%Windows%\AppPatch\Custom\{eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{eeccdd9e-a118-4804-982b-0aa444c1ec70}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{eeccdd9e-a118-4804-982b-0aa444c1ec70}
DatabaseDescription = "msmsgs.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb
DisplayName = "avant.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{0f2a54c5-4bce-48ae-959f-010502eef6bd}
DatabasePath = "%Windows%\AppPatch\Custom\{0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{0f2a54c5-4bce-48ae-959f-010502eef6bd}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{0f2a54c5-4bce-48ae-959f-010502eef6bd}
DatabaseDescription = "avant.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{57812750-a427-4319-84cd-256c99455794}.sdb
DisplayName = "lsass.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{57812750-a427-4319-84cd-256c99455794}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{57812750-a427-4319-84cd-256c99455794}
DatabasePath = "%Windows%\AppPatch\Custom\{57812750-a427-4319-84cd-256c99455794}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{57812750-a427-4319-84cd-256c99455794}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{57812750-a427-4319-84cd-256c99455794}
DatabaseDescription = "lsass.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb
DisplayName = "thunderbird.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}
DatabasePath = "%Windows%\AppPatch\Custom\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}
DatabaseDescription = "thunderbird.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb
DisplayName = "thebat.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}
DatabasePath = "%Windows%\AppPatch\Custom\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}
DatabaseDescription = "thebat.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb
DisplayName = "outlook.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}
DatabasePath = "%Windows%\AppPatch\Custom\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}
DatabaseDescription = "outlook.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb
DisplayName = "epic.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{5b12c756-edb7-4be6-8735-ced0aea83ce9}
DatabasePath = "%Windows%\AppPatch\Custom\{5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{5b12c756-edb7-4be6-8735-ced0aea83ce9}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{5b12c756-edb7-4be6-8735-ced0aea83ce9}
DatabaseDescription = "epic.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb
DisplayName = "msimn.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{0d3843c8-9a71-4037-8333-8afc9bec2180}
DatabasePath = "%Windows%\AppPatch\Custom\{0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{0d3843c8-9a71-4037-8333-8afc9bec2180}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{0d3843c8-9a71-4037-8333-8afc9bec2180}
DatabaseDescription = "msimn.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{6ae1d85d-33db-417e-915e-a54c53877a90}.sdb
DisplayName = "seamonkey.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{6ae1d85d-33db-417e-915e-a54c53877a90}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{6ae1d85d-33db-417e-915e-a54c53877a90}
DatabasePath = "%Windows%\AppPatch\Custom\{6ae1d85d-33db-417e-915e-a54c53877a90}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{6ae1d85d-33db-417e-915e-a54c53877a90}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{6ae1d85d-33db-417e-915e-a54c53877a90}
DatabaseDescription = "seamonkey.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb
DisplayName = "iron.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}
DatabasePath = "%Windows%\AppPatch\Custom\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}
DatabaseDescription = "iron.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{010843db-076b-483f-b849-3e20540e94ed}.sdb
DisplayName = "dragon.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{010843db-076b-483f-b849-3e20540e94ed}.sdb
UninstallString = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{010843db-076b-483f-b849-3e20540e94ed}
DatabasePath = "%Windows%\AppPatch\Custom\{010843db-076b-483f-b849-3e20540e94ed}.sdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{010843db-076b-483f-b849-3e20540e94ed}
DatabaseType = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{010843db-076b-483f-b849-3e20540e94ed}
DatabaseDescription = "dragon.exe"
マルウェアは、以下のレジストリ値を変更します。
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4C95A9902ABE0777CED18D6ACCC3372D2748381E
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4BA7B9DDD68788E12FF852E1A024204BF286A8F6
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
47AFB915CDA26D82467B97FA42914468726138DD
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4463C531D7CCC1006794612BB656D3BF8257846F
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
43F9B110D5BAFD48225231B0D0082B372FEF9A54
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
43DDB1FFF3B49B73831407F6BC8B975023D07C50
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4072BA31FEC351438480F62E6CB95508461EAB2F
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
394FF6850B06BE52E51856CC10E180E882B385CC
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
36863563FD5128C7BEA6F005CFE9B43668086CCE
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
2F173F7DE99667AFA57AF80AA2D1B12FAC830338
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
284F55C41A1A7A3F8328D4C262FB376ED6096F24
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
273EE12457FDC4F90C55E82B56167F62F532E547
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
23E594945195F2414803B4D564D2A3A3F5D88B8C
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
216B2A29E62A00CE820146D8244141B92511B279
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
209900B63D955728140CD13622D8C687A4EB0085
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
1F55E8839BAC30728BE7108EDE7B0BB0D3298224
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
049811056AFE9FD0F5BE01685AACE6A5D1C4454C
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0483ED3399AC3608058722EDBC5E4600E3BEF9D7
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0048F8D37B153F6EA2798C323EF4F318A5624A9E
Blob = "{random values}"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
EventMessageFile = "%System%\ESENT.dll"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
CategoryMessageFile = "%System%\ESENT.dll"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
CategoryCount = "1"
(註：変更前の上記レジストリ値は、「10」となります。)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
TypesSupported = "7"
(註：変更前の上記レジストリ値は、「7」となります。)
作成活動
マルウェアは、以下のファイルを作成します。
- %User Temp%\sdb1.tmp
- %User Temp%\SDB3.tmp
- %User Temp%\sdb9.tmp
- %User Temp%\sdbB.tmp
- %User Temp%\SDBE.tmp
- %User Temp%\sdbC.tmp
- %User Temp%\SDBF.tmp
- %User Temp%\SDB13.tmp
- %User Temp%\sdb14.tmp
- %User Temp%\sdb16.tmp
- %User Temp%\sdb1A.tmp
- %User Temp%\SDB1C.tmp
- %User Temp%\sdb1E.tmp
- %User Temp%\SDB21.tmp
- %User Temp%\sdb24.tmp
- %User Temp%\SDB22.tmp
- %User Temp%\SDB27.tmp
- %User Temp%\SDB2E.tmp
- %User Temp%\sdb2B.tmp
- %User Temp%\sdb2D.tmp
- %User Temp%\sdb30.tmp
- %User Temp%\SDB34.tmp
- %User Temp%\sdb39.tmp
- %User Temp%\SDB3B.tmp
- %User Temp%\sdb3E.tmp
- %User Temp%\SDB3D.tmp
- %User Temp%\sdb43.tmp
- %User Temp%\SDB46.tmp
- %User Temp%\sdb48.tmp
- %User Temp%\SDB4C.tmp
- %User Temp%\sdb4E.tmp
- %User Temp%\SDB50.tmp
- %User Temp%\SDB55.tmp
- %User Temp%\SDB5A.tmp
- %User Temp%\sdb57.tmp
- %User Temp%\sdb5D.tmp
- %User Temp%\sdb62.tmp
- %User Temp%\SDB65.tmp
- %User Temp%\sdb6A.tmp
- %User Temp%\SDB68.tmp
- %User Temp%\SDB6D.tmp
- %User Temp%\SDB73.tmp
- %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
- %User Profile%\Content\2BF68F4714092295550497DD56F57004
- %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
- %User Profile%\Content\94308059B57B3142E455B38A6EB92015
- %User Temp%\Cab9A.tmp
- %User Temp%\Tar9C.tmp
- %User Profile%\RSA\MachineKeys
- %Windows%\AppPatch\Custom\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb
- %Windows%\AppPatch\Custom\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb
- %Windows%\AppPatch\Custom\{344fc323-e820-4709-b0e9-a41dd23db924}.sdb
- %Windows%\AppPatch\Custom\{63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb
- %Windows%\AppPatch\Custom\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb
- %Windows%\AppPatch\Custom\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb
- %Windows%\AppPatch\Custom\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb
- %Windows%\AppPatch\Custom\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb
- %Windows%\AppPatch\Custom\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb
- %Windows%\AppPatch\Custom\{73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb
- %Windows%\AppPatch\Custom\{eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb
- %Windows%\AppPatch\Custom\{0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb
- %Windows%\AppPatch\Custom\{57812750-a427-4319-84cd-256c99455794}.sdb
- %Windows%\AppPatch\Custom\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb
- %Windows%\AppPatch\Custom\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb
- %Windows%\AppPatch\Custom\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb
- %Windows%\AppPatch\Custom\{5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb
- %Windows%\AppPatch\Custom\{0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb
- %Windows%\AppPatch\Custom\{6ae1d85d-33db-417e-915e-a54c53877a90}.sdb
- %Windows%\AppPatch\Custom\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb
- %Windows%\AppPatch\Custom\{010843db-076b-483f-b849-3e20540e94ed}.sdb
(註：%User Temp%フォルダは、ユーザの一時フォルダで、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。.. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞" です。.. %Windows%フォルダは、Windowsが利用するフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows" です。.)
その他
マルウェアは、以下の不正なWebサイトにアクセスします。
- http://{BLOCKED}th.net/rbody32
- {BLOCKED}.202.19
- {BLOCKED}.8.139
マルウェアは、実行後、自身を削除します。
このウイルス情報は、自動解析システムにより作成されました。
対応方法
手順 1
Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。
手順 2
不明なレジストリ値を削除します。
警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
- AppCompatFlags
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
- Custom
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- explorer.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
- InstalledSDB
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}
- In HKEY_CURRENT_USER\SOFTWARE
- cxsw
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- opera.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {a48cf2c0-40e0-42e9-a220-863dddcd56c9}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- mozilla.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {344fc323-e820-4709-b0e9-a41dd23db924}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {344fc323-e820-4709-b0e9-a41dd23db924}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- chrome.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {63938229-2036-4820-b89e-d9a9bf62cf1d}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- iexplore.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- navigator.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {fe373cf3-61db-40f1-bb70-17d9bfc60f48}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- firefox.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- firef.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {3ea0472a-32e6-445f-a6c2-30b72d2f023f}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- myie.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- maxthon.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {73112710-b137-4153-8cc6-7bde43f0e0c0}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- msmsgs.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {eeccdd9e-a118-4804-982b-0aa444c1ec70}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- avant.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {0f2a54c5-4bce-48ae-959f-010502eef6bd}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- lsass.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {57812750-a427-4319-84cd-256c99455794}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {57812750-a427-4319-84cd-256c99455794}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- thunderbird.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- thebat.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- outlook.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {20944cfb-37c5-4d84-b0df-c50209b7e8e8}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- epic.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {5b12c756-edb7-4be6-8735-ced0aea83ce9}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- msimn.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {0d3843c8-9a71-4037-8333-8afc9bec2180}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- seamonkey.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {6ae1d85d-33db-417e-915e-a54c53877a90}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {6ae1d85d-33db-417e-915e-a54c53877a90}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- iron.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {b383ab18-4295-447e-a8dd-9bbb7f095b8b}
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
- dragon.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {010843db-076b-483f-b849-3e20540e94ed}.sdb
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB
- {010843db-076b-483f-b849-3e20540e94ed}
手順 3
このレジストリ値を削除します。
警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb
- DisplayName = "explorer.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}
- DatabasePath = "%Windows%\AppPatch\Custom\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}
- DatabaseDescription = "explorer.exe"
- In HKEY_CURRENT_USER\Software
- binaryImage32_0 = "{random values}"
- In HKEY_CURRENT_USER\Software
- binaryImage32_1 = "{random values}"
- In HKEY_CURRENT_USER\Software
- binaryImage32_2 = "{random values}"
- In HKEY_CURRENT_USER\Software
- binaryImage32_3 = "{random values}"
- In HKEY_CURRENT_USER\Software
- binaryImage32_4 = "{random values}"
- In HKEY_CURRENT_USER\Software
- binaryImage32_5 = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb
- DisplayName = "opera.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}
- DatabasePath = "%Windows%\AppPatch\Custom\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}
- DatabaseDescription = "opera.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{344fc323-e820-4709-b0e9-a41dd23db924}.sdb
- DisplayName = "mozilla.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{344fc323-e820-4709-b0e9-a41dd23db924}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{344fc323-e820-4709-b0e9-a41dd23db924}
- DatabasePath = "%Windows%\AppPatch\Custom\{344fc323-e820-4709-b0e9-a41dd23db924}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{344fc323-e820-4709-b0e9-a41dd23db924}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{344fc323-e820-4709-b0e9-a41dd23db924}
- DatabaseDescription = "mozilla.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb
- DisplayName = "chrome.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{63938229-2036-4820-b89e-d9a9bf62cf1d}
- DatabasePath = "%Windows%\AppPatch\Custom\{63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{63938229-2036-4820-b89e-d9a9bf62cf1d}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{63938229-2036-4820-b89e-d9a9bf62cf1d}
- DatabaseDescription = "chrome.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb
- DisplayName = "iexplore.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}
- DatabasePath = "%Windows%\AppPatch\Custom\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}
- DatabaseDescription = "iexplore.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb
- DisplayName = "navigator.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}
- DatabasePath = "%Windows%\AppPatch\Custom\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}
- DatabaseDescription = "navigator.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb
- DisplayName = "firefox.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}
- DatabasePath = "%Windows%\AppPatch\Custom\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}
- DatabaseDescription = "firefox.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb
- DisplayName = "firef.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}
- DatabasePath = "%Windows%\AppPatch\Custom\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}
- DatabaseDescription = "firef.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb
- DisplayName = "myie.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}
- DatabasePath = "%Windows%\AppPatch\Custom\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}
- DatabaseDescription = "myie.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb
- DisplayName = "maxthon.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{73112710-b137-4153-8cc6-7bde43f0e0c0}
- DatabasePath = "%Windows%\AppPatch\Custom\{73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{73112710-b137-4153-8cc6-7bde43f0e0c0}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{73112710-b137-4153-8cc6-7bde43f0e0c0}
- DatabaseDescription = "maxthon.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb
- DisplayName = "msmsgs.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{eeccdd9e-a118-4804-982b-0aa444c1ec70}
- DatabasePath = "%Windows%\AppPatch\Custom\{eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{eeccdd9e-a118-4804-982b-0aa444c1ec70}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{eeccdd9e-a118-4804-982b-0aa444c1ec70}
- DatabaseDescription = "msmsgs.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb
- DisplayName = "avant.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{0f2a54c5-4bce-48ae-959f-010502eef6bd}
- DatabasePath = "%Windows%\AppPatch\Custom\{0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{0f2a54c5-4bce-48ae-959f-010502eef6bd}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{0f2a54c5-4bce-48ae-959f-010502eef6bd}
- DatabaseDescription = "avant.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{57812750-a427-4319-84cd-256c99455794}.sdb
- DisplayName = "lsass.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{57812750-a427-4319-84cd-256c99455794}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{57812750-a427-4319-84cd-256c99455794}
- DatabasePath = "%Windows%\AppPatch\Custom\{57812750-a427-4319-84cd-256c99455794}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{57812750-a427-4319-84cd-256c99455794}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{57812750-a427-4319-84cd-256c99455794}
- DatabaseDescription = "lsass.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb
- DisplayName = "thunderbird.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}
- DatabasePath = "%Windows%\AppPatch\Custom\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}
- DatabaseDescription = "thunderbird.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb
- DisplayName = "thebat.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}
- DatabasePath = "%Windows%\AppPatch\Custom\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}
- DatabaseDescription = "thebat.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb
- DisplayName = "outlook.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}
- DatabasePath = "%Windows%\AppPatch\Custom\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}
- DatabaseDescription = "outlook.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb
- DisplayName = "epic.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{5b12c756-edb7-4be6-8735-ced0aea83ce9}
- DatabasePath = "%Windows%\AppPatch\Custom\{5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{5b12c756-edb7-4be6-8735-ced0aea83ce9}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{5b12c756-edb7-4be6-8735-ced0aea83ce9}
- DatabaseDescription = "epic.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb
- DisplayName = "msimn.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{0d3843c8-9a71-4037-8333-8afc9bec2180}
- DatabasePath = "%Windows%\AppPatch\Custom\{0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{0d3843c8-9a71-4037-8333-8afc9bec2180}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{0d3843c8-9a71-4037-8333-8afc9bec2180}
- DatabaseDescription = "msimn.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6ae1d85d-33db-417e-915e-a54c53877a90}.sdb
- DisplayName = "seamonkey.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6ae1d85d-33db-417e-915e-a54c53877a90}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{6ae1d85d-33db-417e-915e-a54c53877a90}
- DatabasePath = "%Windows%\AppPatch\Custom\{6ae1d85d-33db-417e-915e-a54c53877a90}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{6ae1d85d-33db-417e-915e-a54c53877a90}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{6ae1d85d-33db-417e-915e-a54c53877a90}
- DatabaseDescription = "seamonkey.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb
- DisplayName = "iron.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}
- DatabasePath = "%Windows%\AppPatch\Custom\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}
- DatabaseDescription = "iron.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010843db-076b-483f-b849-3e20540e94ed}.sdb
- DisplayName = "dragon.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010843db-076b-483f-b849-3e20540e94ed}.sdb
- UninstallString = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{010843db-076b-483f-b849-3e20540e94ed}
- DatabasePath = "%Windows%\AppPatch\Custom\{010843db-076b-483f-b849-3e20540e94ed}.sdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{010843db-076b-483f-b849-3e20540e94ed}
- DatabaseType = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{010843db-076b-483f-b849-3e20540e94ed}
- DatabaseDescription = "dragon.exe"
手順 4
変更されたレジストリ値を修正します。
警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
事前に意図的に対象の設定を変更していた場合は、意図するオリジナルの設定に戻してください。変更する値が分からない場合は、システム管理者にお尋ねいただき、レジストリの編集はお客様の責任として行なって頂くようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4C95A9902ABE0777CED18D6ACCC3372D2748381E
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4BA7B9DDD68788E12FF852E1A024204BF286A8F6
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47AFB915CDA26D82467B97FA42914468726138DD
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4463C531D7CCC1006794612BB656D3BF8257846F
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43DDB1FFF3B49B73831407F6BC8B975023D07C50
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4072BA31FEC351438480F62E6CB95508461EAB2F
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2F173F7DE99667AFA57AF80AA2D1B12FAC830338
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\284F55C41A1A7A3F8328D4C262FB376ED6096F24
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E594945195F2414803B4D564D2A3A3F5D88B8C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\216B2A29E62A00CE820146D8244141B92511B279
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\209900B63D955728140CD13622D8C687A4EB0085
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F55E8839BAC30728BE7108EDE7B0BB0D3298224
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\049811056AFE9FD0F5BE01685AACE6A5D1C4454C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: EventMessageFile = "%System%\ESENT.dll"
To: EventMessageFile = ""{random values}""
- From: EventMessageFile = "%System%\ESENT.dll"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: CategoryMessageFile = "%System%\ESENT.dll"
To: CategoryMessageFile = ""{random values}""
- From: CategoryMessageFile = "%System%\ESENT.dll"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: CategoryCount = "1"
To: CategoryCount = ""10""
- From: CategoryCount = "1"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: TypesSupported = "7"
To: TypesSupported = ""7""
- From: TypesSupported = "7"
手順 5
以下のファイルを検索し削除します。
- %User Temp%\sdb1.tmp
- %User Temp%\SDB3.tmp
- %User Temp%\sdb9.tmp
- %User Temp%\sdbB.tmp
- %User Temp%\SDBE.tmp
- %User Temp%\sdbC.tmp
- %User Temp%\SDBF.tmp
- %User Temp%\SDB13.tmp
- %User Temp%\sdb14.tmp
- %User Temp%\sdb16.tmp
- %User Temp%\sdb1A.tmp
- %User Temp%\SDB1C.tmp
- %User Temp%\sdb1E.tmp
- %User Temp%\SDB21.tmp
- %User Temp%\sdb24.tmp
- %User Temp%\SDB22.tmp
- %User Temp%\SDB27.tmp
- %User Temp%\SDB2E.tmp
- %User Temp%\sdb2B.tmp
- %User Temp%\sdb2D.tmp
- %User Temp%\sdb30.tmp
- %User Temp%\SDB34.tmp
- %User Temp%\sdb39.tmp
- %User Temp%\SDB3B.tmp
- %User Temp%\sdb3E.tmp
- %User Temp%\SDB3D.tmp
- %User Temp%\sdb43.tmp
- %User Temp%\SDB46.tmp
- %User Temp%\sdb48.tmp
- %User Temp%\SDB4C.tmp
- %User Temp%\sdb4E.tmp
- %User Temp%\SDB50.tmp
- %User Temp%\SDB55.tmp
- %User Temp%\SDB5A.tmp
- %User Temp%\sdb57.tmp
- %User Temp%\sdb5D.tmp
- %User Temp%\sdb62.tmp
- %User Temp%\SDB65.tmp
- %User Temp%\sdb6A.tmp
- %User Temp%\SDB68.tmp
- %User Temp%\SDB6D.tmp
- %User Temp%\SDB73.tmp
- %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
- %User Profile%\Content\2BF68F4714092295550497DD56F57004
- %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
- %User Profile%\Content\94308059B57B3142E455B38A6EB92015
- %User Temp%\Cab9A.tmp
- %User Temp%\Tar9C.tmp
- %User Profile%\RSA\MachineKeys
- %Windows%\AppPatch\Custom\{a67cdd8c-ed1f-45b9-9b2b-3e97d4f7fc48}.sdb
- %Windows%\AppPatch\Custom\{a48cf2c0-40e0-42e9-a220-863dddcd56c9}.sdb
- %Windows%\AppPatch\Custom\{344fc323-e820-4709-b0e9-a41dd23db924}.sdb
- %Windows%\AppPatch\Custom\{63938229-2036-4820-b89e-d9a9bf62cf1d}.sdb
- %Windows%\AppPatch\Custom\{e020f3ed-6f34-49fc-a94b-d8a6dd38ddb7}.sdb
- %Windows%\AppPatch\Custom\{fe373cf3-61db-40f1-bb70-17d9bfc60f48}.sdb
- %Windows%\AppPatch\Custom\{c46f3e50-c1dc-4662-bc5d-188ba5fb0fa1}.sdb
- %Windows%\AppPatch\Custom\{3ea0472a-32e6-445f-a6c2-30b72d2f023f}.sdb
- %Windows%\AppPatch\Custom\{01ef7749-a0dd-4ed5-a1c9-18ee1d40218c}.sdb
- %Windows%\AppPatch\Custom\{73112710-b137-4153-8cc6-7bde43f0e0c0}.sdb
- %Windows%\AppPatch\Custom\{eeccdd9e-a118-4804-982b-0aa444c1ec70}.sdb
- %Windows%\AppPatch\Custom\{0f2a54c5-4bce-48ae-959f-010502eef6bd}.sdb
- %Windows%\AppPatch\Custom\{57812750-a427-4319-84cd-256c99455794}.sdb
- %Windows%\AppPatch\Custom\{65042ac8-0415-4f01-b1bd-ef7ea2a80f2a}.sdb
- %Windows%\AppPatch\Custom\{f1b8e627-17f8-42ed-b13e-c0cf9a5db24e}.sdb
- %Windows%\AppPatch\Custom\{20944cfb-37c5-4d84-b0df-c50209b7e8e8}.sdb
- %Windows%\AppPatch\Custom\{5b12c756-edb7-4be6-8735-ced0aea83ce9}.sdb
- %Windows%\AppPatch\Custom\{0d3843c8-9a71-4037-8333-8afc9bec2180}.sdb
- %Windows%\AppPatch\Custom\{6ae1d85d-33db-417e-915e-a54c53877a90}.sdb
- %Windows%\AppPatch\Custom\{b383ab18-4295-447e-a8dd-9bbb7f095b8b}.sdb
- %Windows%\AppPatch\Custom\{010843db-076b-483f-b849-3e20540e94ed}.sdb
手順 6
以下のフォルダを検索し削除します。
- %Windows%\AppPatch\Custom
- %User Profile%\CryptnetUrlCache\MetaData
- %User Profile%\Microsoft\CryptnetUrlCache
- %User Profile%\CryptnetUrlCache\Content
手順 7
最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「TROJ_YAKES.DUKNB」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。
ご利用はいかがでしたか？ アンケートにご協力ください