プラットフォーム:

Windows

 危険度:
 ダメージ度:
 感染力:
 感染確認数:

  • マルウェアタイプ:
    トロイの木馬型

  • 破壊活動の有無:
    なし

  • 暗号化:
     

  • 感染報告の有無 :
    はい

  概要

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 75,420,902 bytes
タイプ EXE
メモリ常駐 はい
発見日 2020年6月4日

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のフォルダを作成します。

  • %User Temp%\.net\{malware file name}\890\ru
  • %User Temp%\.net\{malware file name}\890\ko
  • %User Temp%\.net\{malware file name}\890\zh-Hant
  • %User Temp%\.net\{malware file name}\890
  • %User Temp%\.net\{malware file name}\890\ja
  • %User Temp%\.net\{malware file name}\890\fr
  • %User Temp%\.net\{malware file name}
  • %User Temp%\.net
  • %User Temp%\.net\{malware file name}\890\zh-Hans
  • %User Temp%\.net\{malware file name}\890\tr
  • %User Temp%\.net\{malware file name}\890\it
  • %User Temp%\.net\{malware file name}\890\pl
  • %User Temp%\.net\{malware file name}\890\es
  • %User Temp%\.net\{malware file name}\890\cs
  • %User Temp%\.net\{malware file name}\890\de
  • %User Temp%\.net\{malware file name}\890\pt-BR

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

他のシステム変更

マルウェアは、以下のファイルを削除します。

  • %User Temp%\.net\{malware file name}\890

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

作成活動

マルウェアは、以下のファイルを作成します。

  • %User Temp%\.net\{malware file name}\890\System.ServiceProcess.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Timer.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Tasks.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.RegularExpressions.dll
  • %User Temp%\.net\{malware file name}\890\pl\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\clrcompression.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.Annotations.dll
  • %User Temp%\.net\{malware file name}\890\it\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CodeAnalysis.Scripting.dll
  • %User Temp%\.net\{malware file name}\890\System.Transactions.Local.dll
  • %User Temp%\.net\{malware file name}\890\ko\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.Watcher.dll
  • %User Temp%\.net\{malware file name}\890\System.Console.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Emit.ILGeneration.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Intrinsics.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.TextWriterTraceListener.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-environment-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Emit.Lightweight.dll
  • %User Temp%\.net\{malware file name}\890\System.Core.dll
  • %User Temp%\.net\{malware file name}\890\ja\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-synch-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.Win32.SystemEvents.dll
  • %User Temp%\.net\{malware file name}\890\System.Linq.dll
  • %User Temp%\.net\{malware file name}\890\Windows Battery notification icon.deps.json
  • %User Temp%\.net\{malware file name}\890\System.Private.Uri.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.WindowsRuntime.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-interlocked-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.Json.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.InteropServices.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-private-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Algorithms.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.OpenSsl.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-filesystem-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\ru\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.dll
  • %User Temp%\.net\{malware file name}\890\pl\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hans\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Compression.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.VisualBasic.Core.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-processthreads-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Mail.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Encoding.CodePages.dll
  • %User Temp%\.net\{malware file name}\890\System.ValueTuple.dll
  • %User Temp%\.net\{malware file name}\890\System.ServiceModel.Web.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-memory-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Tasks.Parallel.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.AccessControl.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.Immutable.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Tools.dll
  • %User Temp%\.net\{malware file name}\890\System.Numerics.dll
  • %User Temp%\.net\{malware file name}\890\it\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Globalization.Calendars.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hant\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebSockets.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.DiagnosticSource.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-heap-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Web.dll
  • %User Temp%\.net\{malware file name}\890\pt-BR\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CSharp.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Encoding.dll
  • %User Temp%\.net\{malware file name}\890\tr\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-localization-l1-2-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XmlSerializer.dll
  • %User Temp%\.net\{malware file name}\890\mscordaccore.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XPath.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-math-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Globalization.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-utility-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\ko\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\ru\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.NetworkInformation.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Tasks.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\tr\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-multibyte-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\cs\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Numerics.Vectors.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Principal.Windows.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-debug-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.DriveInfo.dll
  • %User Temp%\.net\{malware file name}\890\cs\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\it\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-conio-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.Win32.Registry.dll
  • %User Temp%\.net\{malware file name}\890\System.Linq.Expressions.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Overlapped.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-console-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-process-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\clrjit.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Pipes.AccessControl.dll
  • %User Temp%\.net\{malware file name}\890\tr\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CodeAnalysis.CSharp.dll
  • %User Temp%\.net\{malware file name}\890\System.Drawing.dll
  • %User Temp%\.net\{malware file name}\890\de\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Http.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebSockets.Client.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.Concurrent.dll
  • %User Temp%\.net\{malware file name}\890\System.Data.DataSetExtensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebProxy.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.WindowsRuntime.UI.Xaml.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.dll
  • %User Temp%\.net\{malware file name}\890\Windows Battery notification icon.runtimeconfig.json
  • %User Temp%\.net\{malware file name}\890\ucrtbase.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CodeAnalysis.CSharp.Scripting.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.ServicePoint.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-string-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.Linq.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Pipes.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Compression.FileSystem.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.CompilerServices.Unsafe.dll
  • %User Temp%\.net\{malware file name}\890\System.Web.HttpUtility.dll
  • %User Temp%\.net\{malware file name}\890\System.Linq.Parallel.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-namedpipe-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\fr\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-processenvironment-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-convert-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Numerics.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Channels.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.TraceSource.dll
  • %User Temp%\.net\{malware file name}\890\WindowsBase.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-runtime-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\tr\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.Specialized.dll
  • %User Temp%\.net\{malware file name}\890\ja\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Private.Xml.Linq.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-heap-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\pl\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Data.Common.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-file-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hant\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\pt-BR\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebClient.dll
  • %User Temp%\.net\{malware file name}\890\pt-BR\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CodeAnalysis.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.X509Certificates.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-file-l1-2-0.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.DiaSymReader.Native.x86.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.Formatters.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-libraryloader-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\dbgshim.dll
  • %User Temp%\.net\{malware file name}\890\netstandard.dll
  • %User Temp%\.net\{malware file name}\890\System.Data.dll
  • %User Temp%\.net\{malware file name}\890\fr\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Compression.Brotli.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XmlDocument.dll
  • %User Temp%\.net\{malware file name}\890\mscordbi.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Emit.dll
  • %User Temp%\.net\{malware file name}\890\System.dll
  • %User Temp%\.net\{malware file name}\890\System.Configuration.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Encodings.Web.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hant\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.StackTrace.dll
  • %User Temp%\.net\{malware file name}\890\de\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-processthreads-l1-1-1.dll
  • %User Temp%\.net\{malware file name}\890\es\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hans\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\cs\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Ping.dll
  • %User Temp%\.net\{malware file name}\890\it\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-locale-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Private.DataContractSerialization.dll
  • %User Temp%\.net\{malware file name}\890\de\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.TypeConverter.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.Serialization.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Sockets.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Json.dll
  • %User Temp%\.net\{malware file name}\890\fr\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Principal.dll
  • %User Temp%\.net\{malware file name}\890\System.Private.Xml.dll
  • %User Temp%\.net\{malware file name}\890\System.Private.CoreLib.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-util-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.SecureString.dll
  • %User Temp%\.net\{malware file name}\890\mscorlib.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Security.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Thread.dll
  • %User Temp%\.net\{malware file name}\890\System.Buffers.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.InteropServices.RuntimeInformation.dll
  • %User Temp%\.net\{malware file name}\890\SOS_README.md
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-handle-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.VisualBasic.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-datetime-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\es\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\ko\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Claims.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Tasks.Dataflow.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.dll
  • %User Temp%\.net\{malware file name}\890\es\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.DataAnnotations.dll
  • %User Temp%\.net\{malware file name}\890\mscorrc.dll
  • %User Temp%\.net\{malware file name}\890\de\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-rtlsupport-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.MemoryMappedFiles.dll
  • %User Temp%\.net\{malware file name}\890\fr\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.HttpListener.dll
  • %User Temp%\.net\{malware file name}\890\hostfxr.dll
  • %User Temp%\.net\{malware file name}\890\ja\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Dynamic.Runtime.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Compression.ZipFile.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.InteropServices.WindowsRuntime.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.DispatchProxy.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebHeaderCollection.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-time-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Csp.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Contracts.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-string-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\ko\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.EventBasedAsync.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-stdio-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hans\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XPath.XDocument.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-synch-l1-2-0.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-sysinfo-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.ReaderWriter.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Requests.dll
  • %User Temp%\.net\{malware file name}\esl41vqo.jc4
  • %User Temp%\.net\{malware file name}\890\mscordaccore_x86_x86_4.700.20.11803.dll
  • %User Temp%\.net\{malware file name}\890\System.Drawing.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\cs\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.NonGeneric.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Loader.dll
  • %User Temp%\.net\{malware file name}\890\System.Memory.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.Win32.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\mscorrc.debug.dll
  • %User Temp%\.net\{malware file name}\890\pl\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Encoding.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\es\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.TypeExtensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Tracing.dll
  • %User Temp%\.net\{malware file name}\890\System.Globalization.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Transactions.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Debug.dll
  • %User Temp%\.net\{malware file name}\890\clretwrc.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XDocument.dll
  • %User Temp%\.net\{malware file name}\890\ja\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hans\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\ru\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Encoding.dll
  • %User Temp%\.net\{malware file name}\890\System.AppContext.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-file-l2-1-0.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-profile-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\Commun.dll
  • %User Temp%\.net\{malware file name}\890\System.Resources.Reader.dll
  • %User Temp%\.net\{malware file name}\890\Windows Battery notification icon.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.NameResolution.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-errorhandling-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Resources.Writer.dll
  • %User Temp%\.net\{malware file name}\890\System.Resources.ResourceManager.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Handles.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hant\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.UnmanagedMemoryStream.dll
  • %User Temp%\.net\{malware file name}\890\ru\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Linq.Queryable.dll
  • %User Temp%\.net\{malware file name}\890\API-MS-Win-core-xstate-l2-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.Xml.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\pt-BR\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Metadata.dll
  • %User Temp%\.net\{malware file name}\890\hostpolicy.dll
  • %User Temp%\.net\{malware file name}\890\System.Drawing.Common.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Process.dll
  • %User Temp%\.net\{malware file name}\890\System.Windows.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.IsolatedStorage.dll
  • %User Temp%\.net\{malware file name}\890\System.ObjectModel.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.AccessControl.dll
  • %User Temp%\.net\{malware file name}\890\coreclr.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Cng.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.FileVersionInfo.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.CompilerServices.VisualC.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-timezone-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.ThreadPool.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.dll

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

このウイルス情報は、自動解析システムにより作成されました。

  対応方法

対応検索エンジン: 9.850

手順 1

Windows XP、Windows Vista 、Windows 7、および Windows 10 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %User Temp%\.net\{malware file name}\890\System.ServiceProcess.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Timer.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Tasks.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.RegularExpressions.dll
  • %User Temp%\.net\{malware file name}\890\pl\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\clrcompression.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.Annotations.dll
  • %User Temp%\.net\{malware file name}\890\it\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CodeAnalysis.Scripting.dll
  • %User Temp%\.net\{malware file name}\890\System.Transactions.Local.dll
  • %User Temp%\.net\{malware file name}\890\ko\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.Watcher.dll
  • %User Temp%\.net\{malware file name}\890\System.Console.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Emit.ILGeneration.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Intrinsics.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.TextWriterTraceListener.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-environment-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Emit.Lightweight.dll
  • %User Temp%\.net\{malware file name}\890\System.Core.dll
  • %User Temp%\.net\{malware file name}\890\ja\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-synch-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.Win32.SystemEvents.dll
  • %User Temp%\.net\{malware file name}\890\System.Linq.dll
  • %User Temp%\.net\{malware file name}\890\Windows Battery notification icon.deps.json
  • %User Temp%\.net\{malware file name}\890\System.Private.Uri.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.WindowsRuntime.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-interlocked-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.Json.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.InteropServices.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-private-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Algorithms.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.OpenSsl.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-filesystem-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\ru\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.dll
  • %User Temp%\.net\{malware file name}\890\pl\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hans\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Compression.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.VisualBasic.Core.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-processthreads-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Mail.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Encoding.CodePages.dll
  • %User Temp%\.net\{malware file name}\890\System.ValueTuple.dll
  • %User Temp%\.net\{malware file name}\890\System.ServiceModel.Web.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-memory-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Tasks.Parallel.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.AccessControl.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.Immutable.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Tools.dll
  • %User Temp%\.net\{malware file name}\890\System.Numerics.dll
  • %User Temp%\.net\{malware file name}\890\it\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Globalization.Calendars.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hant\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebSockets.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.DiagnosticSource.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-heap-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Web.dll
  • %User Temp%\.net\{malware file name}\890\pt-BR\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CSharp.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Encoding.dll
  • %User Temp%\.net\{malware file name}\890\tr\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-localization-l1-2-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XmlSerializer.dll
  • %User Temp%\.net\{malware file name}\890\mscordaccore.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XPath.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-math-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Globalization.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-utility-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\ko\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\ru\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.NetworkInformation.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Tasks.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\tr\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-multibyte-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\cs\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Numerics.Vectors.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Principal.Windows.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-debug-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.DriveInfo.dll
  • %User Temp%\.net\{malware file name}\890\cs\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\it\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-conio-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.Win32.Registry.dll
  • %User Temp%\.net\{malware file name}\890\System.Linq.Expressions.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Overlapped.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-console-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-process-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\clrjit.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Pipes.AccessControl.dll
  • %User Temp%\.net\{malware file name}\890\tr\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CodeAnalysis.CSharp.dll
  • %User Temp%\.net\{malware file name}\890\System.Drawing.dll
  • %User Temp%\.net\{malware file name}\890\de\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Http.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebSockets.Client.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.Concurrent.dll
  • %User Temp%\.net\{malware file name}\890\System.Data.DataSetExtensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebProxy.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.WindowsRuntime.UI.Xaml.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.dll
  • %User Temp%\.net\{malware file name}\890\Windows Battery notification icon.runtimeconfig.json
  • %User Temp%\.net\{malware file name}\890\ucrtbase.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CodeAnalysis.CSharp.Scripting.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.ServicePoint.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-string-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.Linq.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Pipes.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Compression.FileSystem.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.CompilerServices.Unsafe.dll
  • %User Temp%\.net\{malware file name}\890\System.Web.HttpUtility.dll
  • %User Temp%\.net\{malware file name}\890\System.Linq.Parallel.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-namedpipe-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\fr\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-processenvironment-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-convert-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Numerics.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Channels.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.TraceSource.dll
  • %User Temp%\.net\{malware file name}\890\WindowsBase.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-runtime-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\tr\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.Specialized.dll
  • %User Temp%\.net\{malware file name}\890\ja\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Private.Xml.Linq.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-heap-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\pl\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Data.Common.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-file-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hant\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\pt-BR\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebClient.dll
  • %User Temp%\.net\{malware file name}\890\pt-BR\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.CodeAnalysis.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.X509Certificates.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-file-l1-2-0.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.DiaSymReader.Native.x86.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.Formatters.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-libraryloader-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\dbgshim.dll
  • %User Temp%\.net\{malware file name}\890\netstandard.dll
  • %User Temp%\.net\{malware file name}\890\System.Data.dll
  • %User Temp%\.net\{malware file name}\890\fr\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Compression.Brotli.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XmlDocument.dll
  • %User Temp%\.net\{malware file name}\890\mscordbi.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Emit.dll
  • %User Temp%\.net\{malware file name}\890\System.dll
  • %User Temp%\.net\{malware file name}\890\System.Configuration.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Encodings.Web.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hant\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.StackTrace.dll
  • %User Temp%\.net\{malware file name}\890\de\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-processthreads-l1-1-1.dll
  • %User Temp%\.net\{malware file name}\890\es\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hans\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\cs\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Ping.dll
  • %User Temp%\.net\{malware file name}\890\it\Microsoft.CodeAnalysis.CSharp.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-locale-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Private.DataContractSerialization.dll
  • %User Temp%\.net\{malware file name}\890\de\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.TypeConverter.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.Serialization.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Sockets.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Json.dll
  • %User Temp%\.net\{malware file name}\890\fr\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Principal.dll
  • %User Temp%\.net\{malware file name}\890\System.Private.Xml.dll
  • %User Temp%\.net\{malware file name}\890\System.Private.CoreLib.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-util-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.SecureString.dll
  • %User Temp%\.net\{malware file name}\890\mscorlib.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Security.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Thread.dll
  • %User Temp%\.net\{malware file name}\890\System.Buffers.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.InteropServices.RuntimeInformation.dll
  • %User Temp%\.net\{malware file name}\890\SOS_README.md
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-handle-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.VisualBasic.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-datetime-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\es\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\ko\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Claims.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.Tasks.Dataflow.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.dll
  • %User Temp%\.net\{malware file name}\890\es\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.DataAnnotations.dll
  • %User Temp%\.net\{malware file name}\890\mscorrc.dll
  • %User Temp%\.net\{malware file name}\890\de\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-rtlsupport-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.MemoryMappedFiles.dll
  • %User Temp%\.net\{malware file name}\890\fr\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.HttpListener.dll
  • %User Temp%\.net\{malware file name}\890\hostfxr.dll
  • %User Temp%\.net\{malware file name}\890\ja\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Dynamic.Runtime.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.Compression.ZipFile.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.InteropServices.WindowsRuntime.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.DispatchProxy.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.WebHeaderCollection.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-time-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Csp.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Contracts.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-string-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\ko\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.EventBasedAsync.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-crt-stdio-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hans\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XPath.XDocument.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-synch-l1-2-0.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-sysinfo-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.ReaderWriter.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.Requests.dll
  • %User Temp%\.net\{malware file name}\esl41vqo.jc4
  • %User Temp%\.net\{malware file name}\890\mscordaccore_x86_x86_4.700.20.11803.dll
  • %User Temp%\.net\{malware file name}\890\System.Drawing.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\cs\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Collections.NonGeneric.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Loader.dll
  • %User Temp%\.net\{malware file name}\890\System.Memory.dll
  • %User Temp%\.net\{malware file name}\890\Microsoft.Win32.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\mscorrc.debug.dll
  • %User Temp%\.net\{malware file name}\890\pl\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Encoding.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\es\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.ComponentModel.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.TypeExtensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Tracing.dll
  • %User Temp%\.net\{malware file name}\890\System.Globalization.Extensions.dll
  • %User Temp%\.net\{malware file name}\890\System.Transactions.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Debug.dll
  • %User Temp%\.net\{malware file name}\890\clretwrc.dll
  • %User Temp%\.net\{malware file name}\890\System.Xml.XDocument.dll
  • %User Temp%\.net\{malware file name}\890\ja\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hans\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\ru\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Text.Encoding.dll
  • %User Temp%\.net\{malware file name}\890\System.AppContext.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-file-l2-1-0.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-profile-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\Commun.dll
  • %User Temp%\.net\{malware file name}\890\System.Resources.Reader.dll
  • %User Temp%\.net\{malware file name}\890\Windows Battery notification icon.dll
  • %User Temp%\.net\{malware file name}\890\System.Net.NameResolution.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-errorhandling-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Resources.Writer.dll
  • %User Temp%\.net\{malware file name}\890\System.Resources.ResourceManager.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Handles.dll
  • %User Temp%\.net\{malware file name}\890\zh-Hant\Microsoft.CodeAnalysis.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.UnmanagedMemoryStream.dll
  • %User Temp%\.net\{malware file name}\890\ru\Microsoft.CodeAnalysis.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Linq.Queryable.dll
  • %User Temp%\.net\{malware file name}\890\API-MS-Win-core-xstate-l2-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.Xml.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Primitives.dll
  • %User Temp%\.net\{malware file name}\890\pt-BR\Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
  • %User Temp%\.net\{malware file name}\890\System.Reflection.Metadata.dll
  • %User Temp%\.net\{malware file name}\890\hostpolicy.dll
  • %User Temp%\.net\{malware file name}\890\System.Drawing.Common.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.Process.dll
  • %User Temp%\.net\{malware file name}\890\System.Windows.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.IsolatedStorage.dll
  • %User Temp%\.net\{malware file name}\890\System.ObjectModel.dll
  • %User Temp%\.net\{malware file name}\890\System.IO.FileSystem.AccessControl.dll
  • %User Temp%\.net\{malware file name}\890\coreclr.dll
  • %User Temp%\.net\{malware file name}\890\System.Security.Cryptography.Cng.dll
  • %User Temp%\.net\{malware file name}\890\System.Diagnostics.FileVersionInfo.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.CompilerServices.VisualC.dll
  • %User Temp%\.net\{malware file name}\890\System.Runtime.Serialization.dll
  • %User Temp%\.net\{malware file name}\890\api-ms-win-core-timezone-l1-1-0.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.ThreadPool.dll
  • %User Temp%\.net\{malware file name}\890\System.Threading.dll

手順 3

以下のフォルダを検索し削除します。

[ 詳細 ]
フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %User Temp%\.net\{malware file name}\890\ru
  • %User Temp%\.net\{malware file name}\890\ko
  • %User Temp%\.net\{malware file name}\890\zh-Hant
  • %User Temp%\.net\{malware file name}\890
  • %User Temp%\.net\{malware file name}\890\ja
  • %User Temp%\.net\{malware file name}\890\fr
  • %User Temp%\.net\{malware file name}
  • %User Temp%\.net
  • %User Temp%\.net\{malware file name}\890\zh-Hans
  • %User Temp%\.net\{malware file name}\890\tr
  • %User Temp%\.net\{malware file name}\890\it
  • %User Temp%\.net\{malware file name}\890\pl
  • %User Temp%\.net\{malware file name}\890\es
  • %User Temp%\.net\{malware file name}\890\cs
  • %User Temp%\.net\{malware file name}\890\de
  • %User Temp%\.net\{malware file name}\890\pt-BR

手順 4

最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「Trojan.Win32.WACAPEW.AB」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 5

以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

  • %User Temp%\.net\{malware file name}\890


ご利用はいかがでしたか？　アンケートにご協力ください