TSPY_KOVTER.XXP

スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

スパイウェアは、実行後、自身を削除します。

侵入方法

スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

スパイウェアは、以下のフォルダを作成します。

• %Application Data%\yzezo
• %System Root%\_117140_
• %System Root%\e62732dff6db18e12edee9c9b33eaa
• %System Root%\e62732dff6db18e12edee9c9b33eaa\update

(註：%Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming" です。.. %System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.)

他のシステム変更

スパイウェアは、以下のレジストリキーを追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION

HKEY_CURRENT_USER\Software\qanz

HKEY_LOCAL_MACHINE\SOFTWARE\qanz

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate\
OSUpgrade

HKEY_LOCAL_MACHINE\SOFTWARE\81F5E9A33F4A325E

HKEY_LOCAL_MACHINE\SOFTWARE\FA90F84250D3ED293A01

スパイウェアは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
regsvr32.exe = "22b8"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
iexplore.exe = "22b8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
regsvr32.exe = "22b8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
iexplore.exe = "22b8"

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
zojewbdazo = "{random characters}"

HKEY_CURRENT_USER\Software\qanz
zojewbdazo = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate
DisableOSUpgrade = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate\
OSUpgrade
ReservationsAllowed = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
ltpxeirzlt = "dzkVgcJsUDuNLg=="

HKEY_CURRENT_USER\Software\qanz
ltpxeirzlt = "eG1HjpM6VwW0dw=="

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
bjtkim = "cG0W2sM6Uu8tUvR/AiIoJEWqqO17KMI="

HKEY_CURRENT_USER\Software\qanz
bjtkim = "dGwS3pFpVAi/lyzJ8jKpkyfJnptp2Ww="

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
eljz = "JjtAiMc4WPYMEHD2AMpLXAA="

HKEY_CURRENT_USER\Software\qanz
eljz = "dWoXgMBpVs6CFyyQ2Jx6z7w="

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
kqdg = "{random characters}"

HKEY_CURRENT_USER\Software\qanz
kqdg = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\81F5E9A33F4A325E
BFA587C23C5F57AC5C = "BFA587C23C5F57AC5C"

HKEY_LOCAL_MACHINE\SOFTWARE\FA90F84250D3ED293A01
A7A422E7A6D236206D = "A7A422E7A6D236206D"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
LogLevel = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
LogLevel = "0"

スパイウェアは、以下のレジストリ値を変更します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1206 = "0"

(註：変更前の上記レジストリ値は、「3」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2300 = "0"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1809 = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1206 = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
2300 = "0"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1809 = "3"

(註：変更前の上記レジストリ値は、「3」となります。)

スパイウェアは、以下のレジストリキーを削除します。

HKEY_LOCAL_MACHINE\SOFTWARE

作成活動

スパイウェアは、以下のファイルを作成します。

• %Application Data%\yzezo\yzezo.exe
• %User Temp%\WindowsXP-KB968930-x86-ENG.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\eventforwarding.adm
• %System Root%\e62732dff6db18e12edee9c9b33eaa\windowsremotemanagement.adm
• %System Root%\e62732dff6db18e12edee9c9b33eaa\windowsremoteshell.adm
• %System Root%\e62732dff6db18e12edee9c9b33eaa\windowspowershellhelp.chm
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrm.cmd
• %System Root%\e62732dff6db18e12edee9c9b33eaa\compiledcomposition.microsoft.powershell.gpowershell.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.backgroundintelligenttransfer.management.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.backgroundintelligenttransfer.management.interop.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.backgroundintelligenttransfer.management.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.commands.diagnostics.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.commands.diagnostics.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.commands.management.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.commands.management.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.commands.utility.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.commands.utility.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.consolehost.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.consolehost.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.editor.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.editor.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.gpowershell.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.gpowershell.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.graphicalhost.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.graphicalhost.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.security.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.security.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.wsman.management.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.wsman.management.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.wsman.runtime.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\powershell_ise.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\pspluginwkr.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\pwrshmsg.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\pwrshplugin.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\pwrshsip.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\spmsg.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\system.management.automation.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\system.management.automation.resources.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wevtfwd.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrmprov.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrscmd.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrsmgr.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrssrv.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmauto.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmplpxy.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmres.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmsvc.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmwmipl.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\powershell.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\powershell_ise.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\pscustomsetuputil.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\pssetupnativeutils.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\spuninst.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\spupdsvc.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrs.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrshost.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmanhttpconfig.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmprovhost.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wtrinstaller.ico
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrm.ini
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrmprov.mof
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmauto.mof
• %System Root%\e62732dff6db18e12edee9c9b33eaa\powershell.exe.mui
• %System Root%\e62732dff6db18e12edee9c9b33eaa\profile.ps1
• %System Root%\e62732dff6db18e12edee9c9b33eaa\bitstransfer.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\certificate.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\diagnostics.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\dotnettypes.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\filesystem.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\getevent.types.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\help.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\powershellcore.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\powershelltrace.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\registry.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\types.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsman.format.ps1xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\bitstransfer.psd1
• %System Root%\e62732dff6db18e12edee9c9b33eaa\importallmodules.psd1
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_aliases.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_arithmetic_operators.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_arrays.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_assignment_operators.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_automatic_variables.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_bits_cmdlets.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_break.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_command_precedence.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_command_syntax.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_comment_based_help.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_commonparameters.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_comparison_operators.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_continue.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_core_commands.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_data_sections.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_debuggers.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_do.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_environment_variables.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_escape_characters.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_eventlogs.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_execution_policies.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_for.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_foreach.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_format.ps1xml.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_functions.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_functions_advanced.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_functions_advanced_methods.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_functions_advanced_parameters.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_functions_cmdletbindingattribute.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_hash_tables.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_history.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_if.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_job_details.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_jobs.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_join.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_language_keywords.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_line_editing.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_locations.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_logical_operators.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_methods.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_modules.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_objects.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_operators.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_parameters.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_parsing.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_path_syntax.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_pipelines.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_preference_variables.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_profiles.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_prompts.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_properties.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_providers.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_pssession_details.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_pssessions.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_pssnapins.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_quoting_rules.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_redirection.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_ref.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_regular_expressions.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_remote.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_remote_faq.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_remote_jobs.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_remote_output.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_remote_requirements.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_remote_troubleshooting.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_requires.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_reserved_words.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_return.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_scopes.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_script_blocks.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_script_internationalization.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_scripts.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_session_configurations.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_signing.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_special_characters.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_split.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_switch.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_throw.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_transactions.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_trap.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_try_catch_finally.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_type_operators.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_types.ps1xml.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_variables.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_while.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_wildcards.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_windows_powershell_2.0.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_windows_powershell_ise.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_wmi_cmdlets.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\about_ws-management_cmdlets.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\default.help.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\winrm.vbs
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.backgroundintelligenttransfer.management.dll-help.xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.commands.diagnostics.dll-help.xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.commands.management.dll-help.xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.commands.utility.dll-help.xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.consolehost.dll-help.xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.powershell.security.dll-help.xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\microsoft.wsman.management.dll-help.xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\system.management.automation.dll-help.xml
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmpty.xsl
• %System Root%\e62732dff6db18e12edee9c9b33eaa\wsmtxt.xsl
• %System Root%\e62732dff6db18e12edee9c9b33eaa\update\kb968930xp.cat
• %System Root%\e62732dff6db18e12edee9c9b33eaa\update\spcustom.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\update\updspapi.dll
• %System Root%\e62732dff6db18e12edee9c9b33eaa\update\update.exe
• %System Root%\e62732dff6db18e12edee9c9b33eaa\update\update.inf
• %System Root%\e62732dff6db18e12edee9c9b33eaa\update\eula.txt
• %System Root%\e62732dff6db18e12edee9c9b33eaa\update\update.ver
• %System Root%\e62732dff6db18e12edee9c9b33eaa\$shtdwn$.req

その他

スパイウェアは、以下の不正なWebサイトにアクセスします。

• http://{BLOCKED}7.72.90
• http://{BLOCKED}7.72.90/{random path}
• {BLOCKED}.188.202
• {BLOCKED}247.76
• {BLOCKED}.214.105
• {BLOCKED}.201.141
• {BLOCKED}52.53
• {BLOCKED}.74.39
• {BLOCKED}.225.145
• {BLOCKED}.137.114
• {BLOCKED}.240.60
• {BLOCKED}0.36.45
• {BLOCKED}.222.249
• {BLOCKED}.242.184
• {BLOCKED}.70.82
• {BLOCKED}8.208.76
• {BLOCKED}.2.5
• {BLOCKED}.221.234
• {BLOCKED}.66.33
• {BLOCKED}.123.11
• {BLOCKED}54.11
• {BLOCKED}100.248
• {BLOCKED}1.34.69
• {BLOCKED}.83.207
• {BLOCKED}87.194
• {BLOCKED}3.159.255
• {BLOCKED}0.246.167
• {BLOCKED}241.125
• {BLOCKED}.189.178
• {BLOCKED}.197.200
• {BLOCKED}.36.65
• {BLOCKED}6.79.29
• {BLOCKED}3.46.251
• {BLOCKED}.69.140
• {BLOCKED}.116.75
• {BLOCKED}.161.249
• {BLOCKED}.20.46
• {BLOCKED}.75.179
• {BLOCKED}164.228
• {BLOCKED}.130.88
• {BLOCKED}.243.149
• {BLOCKED}3.70.133
• {BLOCKED}9.58.144
• {BLOCKED}.145.171
• {BLOCKED}.34.239
• {BLOCKED}.193.90
• {BLOCKED}204.235
• {BLOCKED}.137.152
• {BLOCKED}3.147
• {BLOCKED}42.12
• {BLOCKED}2.133.113
• {BLOCKED}.136.164
• {BLOCKED}9.149.89
• {BLOCKED}111.54
• {BLOCKED}208.161
• {BLOCKED}8.118.211
• {BLOCKED}.138.116
• {BLOCKED}0.188.16
• {BLOCKED}3.12.194
• {BLOCKED}.234.212
• {BLOCKED}.30.87
• {BLOCKED}.194.213
• {BLOCKED}7.183.82
• {BLOCKED}8.224.169
• {BLOCKED}.240.29
• {BLOCKED}5.252.128
• {BLOCKED}2.42.60
• {BLOCKED}146.28
• {BLOCKED}2.174
• {BLOCKED}.181.143
• {BLOCKED}0.16.158
• {BLOCKED}0.127.218
• {BLOCKED}7.177.176
• {BLOCKED}5.233.222
• {BLOCKED}6.178.55
• {BLOCKED}.147.59
• {BLOCKED}29.199
• {BLOCKED}2.99.245
• {BLOCKED}.182.236
• {BLOCKED}3.236.67
• {BLOCKED}48.200
• {BLOCKED}0.63.154
• {BLOCKED}29.85
• {BLOCKED}.241.66
• {BLOCKED}.183.150
• {BLOCKED}135.188
• {BLOCKED}95.161
• {BLOCKED}.168.220
• {BLOCKED}20.15
• {BLOCKED}66.14
• {BLOCKED}0.237.148
• {BLOCKED}.172.106
• {BLOCKED}.200.30
• {BLOCKED}22.18
• {BLOCKED}.32.19
• {BLOCKED}3.95.13
• {BLOCKED}.54.66
• {BLOCKED}5.146.251
• {BLOCKED}8.206.232
• {BLOCKED}.128.101
• {BLOCKED}.154.239
• {BLOCKED}1.10.196
• {BLOCKED}.224.9
• {BLOCKED}5.127
• {BLOCKED}1.149.94
• {BLOCKED}1.233.182
• {BLOCKED}.105.57
• {BLOCKED}0.17.188
• {BLOCKED}6.119.71
• {BLOCKED}9.180.113
• {BLOCKED}5.71.113
• {BLOCKED}.225.223
• {BLOCKED}5.63.74
• {BLOCKED}3.203.253
• {BLOCKED}160.168
• {BLOCKED}.50.221
• {BLOCKED}5.236.20
• {BLOCKED}2.64.92
• {BLOCKED}8.97.118
• {BLOCKED}186.168
• {BLOCKED}13.42
• {BLOCKED}.26.210
• {BLOCKED}.194.185
• {BLOCKED}.3.187
• {BLOCKED}.230.31
• {BLOCKED}.119.3
• {BLOCKED}4.250.72
• {BLOCKED}7.62.15
• {BLOCKED}9.16.82
• {BLOCKED}.208.21
• {BLOCKED}.174.35
• {BLOCKED}6.146.33
• {BLOCKED}1.164.198
• {BLOCKED}0.1.197
• {BLOCKED}.32.81
• {BLOCKED}48.158
• {BLOCKED}4.236.151
• {BLOCKED}.70.63
• {BLOCKED}.192.249
• {BLOCKED}.193.82
• {BLOCKED}.182.6
• {BLOCKED}0.220.146
• {BLOCKED}2.7.46
• {BLOCKED}.19.85
• {BLOCKED}9.6.60
• {BLOCKED}2.177.46
• {BLOCKED}.107.27
• {BLOCKED}.153.139
• {BLOCKED}.212.230
• {BLOCKED}4.12.33
• {BLOCKED}.47.103
• {BLOCKED}5.139.235
• {BLOCKED}5.53.1
• {BLOCKED}3.98.76
• {BLOCKED}.39.56
• {BLOCKED}9.191.57
• {BLOCKED}8.238.52
• {BLOCKED}5.112.22
• {BLOCKED}.153.7
• {BLOCKED}.96.28
• {BLOCKED}.156.180
• {BLOCKED}.34.76
• {BLOCKED}.128.27
• {BLOCKED}0.143.96
• {BLOCKED}.49.196
• {BLOCKED}19.194
• {BLOCKED}4.20.24
• {BLOCKED}0.165.15
• {BLOCKED}.177.183
• {BLOCKED}.218.16
• {BLOCKED}.22.59
• {BLOCKED}.190.212
• {BLOCKED}3.196.150
• {BLOCKED}5.29.196
• {BLOCKED}.154.106
• {BLOCKED}5.173.178
• {BLOCKED}.196.7
• {BLOCKED}7.205.155
• {BLOCKED}0.112.120
• {BLOCKED}.237.143
• {BLOCKED}.83.244
• {BLOCKED}101.147
• {BLOCKED}.182.69
• {BLOCKED}.176.155
• {BLOCKED}.52.113
• {BLOCKED}175.120
• {BLOCKED}78.237
• {BLOCKED}8.178.11
• {BLOCKED}48.146
• {BLOCKED}0.119.201
• {BLOCKED}8.147.226
• {BLOCKED}6.204.243
• {BLOCKED}.160.39
• {BLOCKED}2.77.7
• {BLOCKED}.216.242
• {BLOCKED}243.147
• {BLOCKED}3.123.173
• {BLOCKED}6.42.35
• {BLOCKED}235.46
• {BLOCKED}39.195
• {BLOCKED}1.230.116
• {BLOCKED}1.84.141
• {BLOCKED}.136.138
• {BLOCKED}187.131
• {BLOCKED}.197.133
• {BLOCKED}143.179
• {BLOCKED}.172.253
• {BLOCKED}3.37.230
• {BLOCKED}.224.202
• {BLOCKED}4.28.232
• {BLOCKED}7.12.153
• {BLOCKED}.18.63
• {BLOCKED}5.109.16
• {BLOCKED}.201.106
• {BLOCKED}.179.192
• {BLOCKED}30.189
• {BLOCKED}.136.157
• {BLOCKED}1.74.167
• {BLOCKED}3.160.21
• {BLOCKED}44.35
• {BLOCKED}6.244.61
• {BLOCKED}2.125.45
• {BLOCKED}6.232.9
• {BLOCKED}.220.144
• {BLOCKED}.157.184
• {BLOCKED}2.238.78
• {BLOCKED}.194.54
• {BLOCKED}2.115.194
• {BLOCKED}9.223.6
• {BLOCKED}112.41

スパイウェアは、実行後、自身を削除します。

このウイルス情報は、自動解析システムにより作成されました。