WORM_AUTORUN.LAS
Windows 2000, Windows XP, Windows Server 2003
![](/vinfo/imgFiles/JPlegend.jpg)
マルウェアタイプ:
ワーム
破壊活動の有無:
なし
暗号化:
感染報告の有無 :
はい
概要
ワームは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
詳細
侵入方法
ワームは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
他のシステム変更
ワームは、以下のファイルを削除します。
- %User Temp%\F1z5uX4958.ini
- %User Temp%\winmfys.exe
- %User Temp%\winakiof.exe
(註:%User Temp%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 2000、XP および Server 2003 の場合、"C:\Documents and Settings\<ユーザー名>\Local Settings\Temp"、Windows Vista および 7 の場合、"C:\Users\<ユーザ名>\AppData\Local\Temp" です。)
ワームは、以下のレジストリキーを追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
HKEY_CURRENT_USER\Software\Afqteuv\
1926745233
ワームは、以下のレジストリ値を追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = "1"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = "{malware path and file name}:*:enabled:ipsec"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"
HKEY_CURRENT_USER\Software\Afqteuv\
1926745233
1651272023 = "d6"
HKEY_CURRENT_USER\Software\Afqteuv\
1926745233
-992423250 = "0"
HKEY_CURRENT_USER\Software\Afqteuv\
1926745233
658848773 = "0"
HKEY_CURRENT_USER\Software\Afqteuv\
1926745233
-1984846500 = "23"
HKEY_CURRENT_USER\Software\Afqteuv\
1926745233
-333574477 = "18a"
HKEY_CURRENT_USER\Software\Afqteuv\
1926745233
1317697546 = "{random characters}"
HKEY_CURRENT_USER\Software\Afqteuv\
1926745233
-1325997727 = "{random characters}"
HKEY_CURRENT_USER\Software\Afqteuv
W1_0 = "c4a71155"
HKEY_CURRENT_USER\Software\Afqteuv
W2_0 = "2668"
HKEY_CURRENT_USER\Software\Afqteuv
W3_0 = "136a29"
HKEY_CURRENT_USER\Software\Afqteuv
W4_0 = "0"
HKEY_CURRENT_USER\Software\Afqteuv
W1_1 = "214f241a"
HKEY_CURRENT_USER\Software\Afqteuv
W2_1 = "626c7c6"
HKEY_CURRENT_USER\Software\Afqteuv
W3_1 = "636f37e"
HKEY_CURRENT_USER\Software\Afqteuv
W4_1 = "626c6957"
HKEY_CURRENT_USER\Software\Afqteuv
W1_2 = "8ce9dcc"
HKEY_CURRENT_USER\Software\Afqteuv
W2_2 = "c4d8c9f3"
HKEY_CURRENT_USER\Software\Afqteuv
W3_2 = "c5dbb887"
HKEY_CURRENT_USER\Software\Afqteuv
W4_2 = "c4d8d2ae"
HKEY_CURRENT_USER\Software\Afqteuv
W1_3 = "222133a8"
HKEY_CURRENT_USER\Software\Afqteuv
W2_3 = "27452a7"
HKEY_CURRENT_USER\Software\Afqteuv
W3_3 = "2646562c"
HKEY_CURRENT_USER\Software\Afqteuv
W4_3 = "27453c5"
HKEY_CURRENT_USER\Software\Afqteuv
W1_4 = "12e1d213"
HKEY_CURRENT_USER\Software\Afqteuv
W2_4 = "89b1b3a"
HKEY_CURRENT_USER\Software\Afqteuv
W3_4 = "88b2cf75"
HKEY_CURRENT_USER\Software\Afqteuv
W4_4 = "89b1a55c"
HKEY_CURRENT_USER\Software\Afqteuv
W1_5 = "32611fd"
HKEY_CURRENT_USER\Software\Afqteuv
W2_5 = "ec1e19f"
HKEY_CURRENT_USER\Software\Afqteuv
W3_5 = "ed1d649a"
HKEY_CURRENT_USER\Software\Afqteuv
W4_5 = "ec1eeb3"
HKEY_CURRENT_USER\Software\Afqteuv
W1_6 = "c93775c"
HKEY_CURRENT_USER\Software\Afqteuv
W2_6 = "4e8a628d"
HKEY_CURRENT_USER\Software\Afqteuv
W3_6 = "4f891223"
HKEY_CURRENT_USER\Software\Afqteuv
W4_6 = "4e8a78a"
HKEY_CURRENT_USER\Software\Afqteuv
W1_7 = "faf7533c"
HKEY_CURRENT_USER\Software\Afqteuv
W2_7 = "bf6fd86"
HKEY_CURRENT_USER\Software\Afqteuv
W3_7 = "b1f58b48"
HKEY_CURRENT_USER\Software\Afqteuv
W4_7 = "bf6e161"
HKEY_CURRENT_USER\Software\Afqteuv
W1_8 = "3d63ed"
HKEY_CURRENT_USER\Software\Afqteuv
W2_8 = "13635c1f"
HKEY_CURRENT_USER\Software\Afqteuv
W3_8 = "126291"
HKEY_CURRENT_USER\Software\Afqteuv
W4_8 = "13634ab8"
HKEY_CURRENT_USER\Software\Afqteuv
W1_9 = "77e4c84b"
HKEY_CURRENT_USER\Software\Afqteuv
W2_9 = "75cfa94"
HKEY_CURRENT_USER\Software\Afqteuv
W3_9 = "74ccde26"
HKEY_CURRENT_USER\Software\Afqteuv
W4_9 = "75cfb4f"
HKEY_CURRENT_USER\Software\Afqteuv
W1_10 = "4395a939"
HKEY_CURRENT_USER\Software\Afqteuv
W2_10 = "d83c8c"
HKEY_CURRENT_USER\Software\Afqteuv
W3_10 = "d93f774f"
HKEY_CURRENT_USER\Software\Afqteuv
W4_10 = "d83c1d66"
HKEY_CURRENT_USER\Software\Afqteuv
W1_11 = "7bfa6e4"
HKEY_CURRENT_USER\Software\Afqteuv
W2_11 = "3aa89b4"
HKEY_CURRENT_USER\Software\Afqteuv
W3_11 = "3babec94"
HKEY_CURRENT_USER\Software\Afqteuv
W4_11 = "3aa886bd"
HKEY_CURRENT_USER\Software\Afqteuv
W1_12 = "1789941"
HKEY_CURRENT_USER\Software\Afqteuv
W2_12 = "9d14ed15"
HKEY_CURRENT_USER\Software\Afqteuv
W3_12 = "9c179a3d"
HKEY_CURRENT_USER\Software\Afqteuv
W4_12 = "9d14f14"
HKEY_CURRENT_USER\Software\Afqteuv
W1_13 = "ad4233e"
HKEY_CURRENT_USER\Software\Afqteuv
W2_13 = "ff817ca1"
HKEY_CURRENT_USER\Software\Afqteuv
W3_13 = "fe823342"
HKEY_CURRENT_USER\Software\Afqteuv
W4_13 = "ff81596b"
HKEY_CURRENT_USER\Software\Afqteuv
W1_14 = "71538bb6"
HKEY_CURRENT_USER\Software\Afqteuv
W2_14 = "61ede257"
HKEY_CURRENT_USER\Software\Afqteuv
W3_14 = "6eea8eb"
HKEY_CURRENT_USER\Software\Afqteuv
W4_14 = "61edc2c2"
HKEY_CURRENT_USER\Software\Afqteuv
W1_15 = "6fe7c7c3"
HKEY_CURRENT_USER\Software\Afqteuv
W2_15 = "c45a3ad8"
HKEY_CURRENT_USER\Software\Afqteuv
W3_15 = "c559463"
HKEY_CURRENT_USER\Software\Afqteuv
W4_15 = "c45a2c19"
HKEY_CURRENT_USER\Software\Afqteuv
W1_16 = "ec2e9cd"
HKEY_CURRENT_USER\Software\Afqteuv
W2_16 = "26c6b5d9"
HKEY_CURRENT_USER\Software\Afqteuv
W3_16 = "27c5ff59"
HKEY_CURRENT_USER\Software\Afqteuv
W4_16 = "26c6957"
HKEY_CURRENT_USER\Software\Afqteuv
W1_17 = "cf14d29e"
HKEY_CURRENT_USER\Software\Afqteuv
W2_17 = "8932e35a"
HKEY_CURRENT_USER\Software\Afqteuv
W3_17 = "883194ee"
HKEY_CURRENT_USER\Software\Afqteuv
W4_17 = "8932fec7"
HKEY_CURRENT_USER\Software\Afqteuv
W1_18 = "dcaaa5a"
HKEY_CURRENT_USER\Software\Afqteuv
W2_18 = "eb9f73f3"
HKEY_CURRENT_USER\Software\Afqteuv
W3_18 = "ea9c237"
HKEY_CURRENT_USER\Software\Afqteuv
W4_18 = "eb9f681e"
HKEY_CURRENT_USER\Software\Afqteuv
W1_19 = "df8d99cb"
HKEY_CURRENT_USER\Software\Afqteuv
W2_19 = "4ebcb36"
HKEY_CURRENT_USER\Software\Afqteuv
W3_19 = "4f8bb5c"
HKEY_CURRENT_USER\Software\Afqteuv
W4_19 = "4ebd175"
HKEY_CURRENT_USER\Software\Afqteuv
W1_20 = "2d6499e"
HKEY_CURRENT_USER\Software\Afqteuv
W2_20 = "b782311"
HKEY_CURRENT_USER\Software\Afqteuv
W3_20 = "b17b5e5"
HKEY_CURRENT_USER\Software\Afqteuv
W4_20 = "b783acc"
HKEY_CURRENT_USER\Software\Afqteuv
W1_21 = "d9d7797"
HKEY_CURRENT_USER\Software\Afqteuv
W2_21 = "12e4b395"
HKEY_CURRENT_USER\Software\Afqteuv
W3_21 = "13e7cea"
HKEY_CURRENT_USER\Software\Afqteuv
W4_21 = "12e4a423"
HKEY_CURRENT_USER\Software\Afqteuv
W1_22 = "4bdb6225"
HKEY_CURRENT_USER\Software\Afqteuv
W2_22 = "75511fd"
HKEY_CURRENT_USER\Software\Afqteuv
W3_22 = "74526753"
HKEY_CURRENT_USER\Software\Afqteuv
W4_22 = "7551d7a"
HKEY_CURRENT_USER\Software\Afqteuv
W1_23 = "db74b815"
HKEY_CURRENT_USER\Software\Afqteuv
W2_23 = "d7bd6fa2"
HKEY_CURRENT_USER\Software\Afqteuv
W3_23 = "d6be1cf8"
HKEY_CURRENT_USER\Software\Afqteuv
W4_23 = "d7bd76d1"
HKEY_CURRENT_USER\Software\Afqteuv
W1_24 = "f9e12eb"
HKEY_CURRENT_USER\Software\Afqteuv
W2_24 = "3a29fd4c"
HKEY_CURRENT_USER\Software\Afqteuv
W3_24 = "3b2a8a1"
HKEY_CURRENT_USER\Software\Afqteuv
W4_24 = "3a29e28"
HKEY_CURRENT_USER\Software\Afqteuv
W1_25 = "f15e1411"
HKEY_CURRENT_USER\Software\Afqteuv
W2_25 = "9c965cc2"
HKEY_CURRENT_USER\Software\Afqteuv
W3_25 = "9d952356"
HKEY_CURRENT_USER\Software\Afqteuv
W4_25 = "9c96497f"
HKEY_CURRENT_USER\Software\Afqteuv
W1_26 = "46c8c48b"
HKEY_CURRENT_USER\Software\Afqteuv
W2_26 = "ff2ad5f"
HKEY_CURRENT_USER\Software\Afqteuv
W3_26 = "fe1d8ff"
HKEY_CURRENT_USER\Software\Afqteuv
W4_26 = "ff2b2d6"
HKEY_CURRENT_USER\Software\Afqteuv
W1_27 = "4ce73274"
HKEY_CURRENT_USER\Software\Afqteuv
W2_27 = "616fb2e"
HKEY_CURRENT_USER\Software\Afqteuv
W3_27 = "66c764"
HKEY_CURRENT_USER\Software\Afqteuv
W4_27 = "616f1c2d"
HKEY_CURRENT_USER\Software\Afqteuv
W1_28 = "e9731bdb"
HKEY_CURRENT_USER\Software\Afqteuv
W2_28 = "c3db9257"
HKEY_CURRENT_USER\Software\Afqteuv
W3_28 = "c2d8efad"
HKEY_CURRENT_USER\Software\Afqteuv
W4_28 = "c3db8584"
HKEY_CURRENT_USER\Software\Afqteuv
W1_29 = "37285e85"
HKEY_CURRENT_USER\Software\Afqteuv
W2_29 = "2647f5fb"
HKEY_CURRENT_USER\Software\Afqteuv
W3_29 = "274484f2"
HKEY_CURRENT_USER\Software\Afqteuv
W4_29 = "2647eedb"
HKEY_CURRENT_USER\Software\Afqteuv
W1_30 = "b166da8e"
HKEY_CURRENT_USER\Software\Afqteuv
W2_30 = "88b44416"
HKEY_CURRENT_USER\Software\Afqteuv
W3_30 = "89b7321b"
HKEY_CURRENT_USER\Software\Afqteuv
W4_30 = "88b45832"
HKEY_CURRENT_USER\Software\Afqteuv
W1_31 = "71659f42"
HKEY_CURRENT_USER\Software\Afqteuv
W2_31 = "eb2e3fc"
HKEY_CURRENT_USER\Software\Afqteuv
W3_31 = "ea23aba"
HKEY_CURRENT_USER\Software\Afqteuv
W4_31 = "eb2c189"
HKEY_CURRENT_USER\Software\Afqteuv
W1_32 = "d29c38b9"
HKEY_CURRENT_USER\Software\Afqteuv
W2_32 = "4d8d33f"
HKEY_CURRENT_USER\Software\Afqteuv
W3_32 = "4c8e4c9"
HKEY_CURRENT_USER\Software\Afqteuv
W4_32 = "4d8d2ae"
HKEY_CURRENT_USER\Software\Afqteuv
W1_33 = "9e7b36e"
HKEY_CURRENT_USER\Software\Afqteuv
W2_33 = "aff98c4d"
HKEY_CURRENT_USER\Software\Afqteuv
W3_33 = "aefafe1e"
HKEY_CURRENT_USER\Software\Afqteuv
W4_33 = "aff99437"
HKEY_CURRENT_USER\Software\Afqteuv
W1_34 = "2dc776c"
HKEY_CURRENT_USER\Software\Afqteuv
W2_34 = "1265e56"
HKEY_CURRENT_USER\Software\Afqteuv
W3_34 = "136697a7"
HKEY_CURRENT_USER\Software\Afqteuv
W4_34 = "1265fd8e"
HKEY_CURRENT_USER\Software\Afqteuv
W1_35 = "df35a75b"
HKEY_CURRENT_USER\Software\Afqteuv
W2_35 = "74d27329"
HKEY_CURRENT_USER\Software\Afqteuv
W3_35 = "75d1ccc"
HKEY_CURRENT_USER\Software\Afqteuv
W4_35 = "74d266e5"
HKEY_CURRENT_USER\Software\Afqteuv
W1_36 = "e5b37cf7"
HKEY_CURRENT_USER\Software\Afqteuv
W2_36 = "d73ecf39"
HKEY_CURRENT_USER\Software\Afqteuv
W3_36 = "d63dba15"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\Explorer.EXE = "%Windows%\Explorer.EXE:*:Enabled:ipsec"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\wscntfy.exe = "%System%\wscntfy.exe:*:Enabled:ipsec"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\winlvpxna.exe = "%User Temp%\winlvpxna.exe:*:Enabled:ipsec"
ワームは、以下のレジストリ値を変更します。
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"
(註:変更前の上記レジストリ値は、「2」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"
ワームは、以下のレジストリキーを削除します。
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Base
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Boot file system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmboot.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmio.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmload.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
dmserver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
EventLog
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
File system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
HelpSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Netlogon
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PCI Configuration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
Primary disk
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
SCSI Class
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
sermouse.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
sr.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
SRService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
vga.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
vgasave.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
WinMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{36FC9E60-C465-11CF-8056-444553540000}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E965-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E969-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96A-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E96F-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E977-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E97B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E97D-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E980-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AFD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Base
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Boot file system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Browser
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Dhcp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmboot.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmio.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmload.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
dmserver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
DnsCache
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
EventLog
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
File system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
HelpSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
ip6fw.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
ipnat.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LanmanServer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LanmanWorkstation
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
LmHosts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Messenger
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NDIS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NDIS Wrapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Ndisuio
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBIOS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBIOSGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetBT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetDDEGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Netlogon
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetMan
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Network
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NetworkProvider
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
NtLmSsp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PCI Configuration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Primary disk
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpcdd.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpdd.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdpwd.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
rdsessmgr
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SCSI Class
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
sermouse.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SharedAccess
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
sr.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
SRService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Streams Drivers
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
TDI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
tdpipe.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
tdtcp.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
termservice
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
vga.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
vgasave.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
WinMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
WZCSVC
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{36FC9E60-C465-11CF-8056-444553540000}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E965-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E969-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96A-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E96F-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E972-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E973-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E974-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E975-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E977-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E97B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E97D-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E980-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{71A27CDD-812A-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network
作成活動
ワームは、以下のファイルを作成します。
- %User Temp%\wh0jHTcRo6.ini
- %System%\drivers\iepqn.sys
- %User Temp%\winuocb.exe
- %User Temp%\winhume.exe
- %User Temp%\wucrr.exe
- %User Temp%\racxm.exe
- %User Temp%\xunj.exe
- %User Temp%\windxdi.exe
- %User Temp%\winlvpxna.exe
- %User Temp%\winmnprll.exe
- %User Temp%\winjugm.exe
- %User Temp%\wvkuw.exe
- %User Temp%\winxrxu.exe
- %User Temp%\winobllli.exe
- %User Temp%\nayno.exe
- %User Temp%\wincawyv.exe
- %User Temp%\winxhmmuh.exe
- %User Temp%\wincdycng.exe
- %User Temp%\lcps.exe
- %User Temp%\engfu.exe
- %User Temp%\cowqtw.exe
- %User Temp%\winjxaj.exe
- %User Temp%\qckqix.exe
- %User Temp%\winrwykx.exe
- %User Temp%\winintnw.exe
- %User Temp%\nfrrw.exe
- %User Temp%\hltgfo.exe
- %User Temp%\winecxo.exe
- %User Temp%\winmdux.exe
- %User Temp%\msjfnk.exe
- %User Temp%\ovpnn.exe
- %User Temp%\ufhl.exe
- %User Temp%\winwtumj.exe
- %User Temp%\winnrxx.exe
- %User Temp%\japqfe.exe
- %User Temp%\winajxvse.exe
- %User Temp%\winhvlwl.exe
- %User Temp%\tvjf.exe
- %User Temp%\svwfj.exe
- %User Temp%\winwurp.exe
- %User Temp%\wincgfn.exe
- %User Temp%\tqldv.exe
- %User Temp%\winiwrke.exe
- %User Temp%\winhevbo.exe
- %User Temp%\winrsgk.exe
- %User Temp%\csayu.exe
- %User Temp%\hrgw.exe
- %User Temp%\winwuexqw.exe
- %User Temp%\winjrery.exe
- %User Temp%\winjrxh.exe
- %User Temp%\winokogg.exe
- %User Temp%\winnyxgjw.exe
- %User Temp%\wingslqk.exe
- %User Temp%\winurmt.exe
- %User Temp%\qyqos.exe
- %User Temp%\winaobqq.exe
(註:%User Temp%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 2000、XP および Server 2003 の場合、"C:\Documents and Settings\<ユーザー名>\Local Settings\Temp"、Windows Vista および 7 の場合、"C:\Users\<ユーザ名>\AppData\Local\Temp" です。. %System%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では "C:\Windows\System32" です。)
その他
ワームは、以下の不正なWebサイトにアクセスします。
- http://{BLOCKED}anirakezen.nl/logo.gif?1464b=83531
- http://www.{BLOCKED}des2013.unlugar.com/logo.gif?14ea7=685368
- http://www.{BLOCKED}rinternational.com/logo.gif?14ec7=771327
- http://ngaoschool.{BLOCKED}c.th/logo.gif?1500f=258093
- http://{BLOCKED}uchoa.com/logos.gif?1533b=521058
- http://{BLOCKED}morales.com/logo.gif?15483=261513
- http://landmarkgroup.{BLOCKED}m.au/images/logos/logos.gif?15687=876870
- http://{BLOCKED}studio.com/images/button.gif?156e5=790029
- http://{BLOCKED}ward.com/images/logo.gif?1678e=276138
- http://www.{BLOCKED}each.de/logo.gif?17402=857106
- http://{BLOCKED}anirakezen.nl/logo.gif?18141=986250
- http://www.{BLOCKED}des2013.unlugar.com/logo.gif?1875b=200374
- http://www.{BLOCKED}rinternational.com/logo.gif?18874=502340
- http://ngaoschool.{BLOCKED}c.th/logo.gif?18bb0=607776
- http://{BLOCKED}uchoa.com/logos.gif?18fc7=818744
- http://{BLOCKED}morales.com/logo.gif?190a2=102562
- http://landmarkgroup.{BLOCKED}m.au/images/logos/logos.gif?192a6=618468
- http://{BLOCKED}studio.com/images/button.gif?193af=826744
- http://{BLOCKED}ward.com/images/logo.gif?19797=730401
- http://www.{BLOCKED}each.de/logo.gif?1a728=758296
- http://{BLOCKED}anirakezen.nl/logo.gif?1b570=1119840
- http://www.{BLOCKED}des2013.unlugar.com/logo.gif?1bacf=680154
- http://www.{BLOCKED}rinternational.com/logo.gif?1bbe8=795480
- http://ngaoschool.{BLOCKED}c.th/logo.gif?1be78=1142960
- http://{BLOCKED}uchoa.com/logos.gif?1c34b=924248
- http://{BLOCKED}morales.com/logo.gif?1c510=695904
- http://landmarkgroup.{BLOCKED}m.au/images/logos/logos.gif?1c771=699558
- http://{BLOCKED}studio.com/images/button.gif?1c956=585390
- http://{BLOCKED}ward.com/images/logo.gif?1cd5d=826763
- http://www.{BLOCKED}each.de/logo.gif?1df5e=368154
- http://{BLOCKED}anirakezen.nl/logo.gif?1ee04=252936
- http://www.{BLOCKED}des2013.unlugar.com/logo.gif?1f392=383670
- http://www.{BLOCKED}rinternational.com/logo.gif?1f4fa=1282500
- http://ngaoschool.{BLOCKED}c.th/logo.gif?1f799=644605
- http://{BLOCKED}uchoa.com/logos.gif?1fc2d=780558
- http://{BLOCKED}morales.com/logo.gif?1fdb4=260968
- http://landmarkgroup.{BLOCKED}m.au/images/logos/logos.gif?20063=1311710
- http://{BLOCKED}studio.com/images/button.gif?2013e=1051120
- http://{BLOCKED}ward.com/images/logo.gif?20584=132484
- http://www.{BLOCKED}each.de/logo.gif?21ea9=1250289
- http://{BLOCKED}anirakezen.nl/logo.gif?22c75=569812
- http://www.{BLOCKED}des2013.unlugar.com/logo.gif?23280=864000
- http://www.{BLOCKED}rinternational.com/logo.gif?233c8=577312
- http://ngaoschool.{BLOCKED}c.th/logo.gif?23713=1016197
- http://{BLOCKED}uchoa.com/logos.gif?23a7e=146046
- http://{BLOCKED}morales.com/logo.gif?23c05=1464370
- http://landmarkgroup.{BLOCKED}m.au/images/logos/logos.gif?23e86=735390
- http://{BLOCKED}studio.com/images/button.gif?23faf=1326375
- http://{BLOCKED}ward.com/images/logo.gif?243c5=1187368
- http://www.{BLOCKED}each.de/logo.gif?2552b=611500
- http://{BLOCKED}anirakezen.nl/logo.gif?2625a=1406250
- http://www.{BLOCKED}des2013.unlugar.com/logo.gif?269db=158171
- http://www.{BLOCKED}rinternational.com/logo.gif?26b43=1585310
- http://ngaoschool.{BLOCKED}c.th/logo.gif?26eec=1116276
- http://{BLOCKED}uchoa.com/logos.gif?27303=963090
- http://{BLOCKED}morales.com/logo.gif?27593=161171
- http://landmarkgroup.{BLOCKED}m.au/images/logos/logos.gif?278ef=1458279
- http://{BLOCKED}studio.com/images/button.gif?27ab4=487452
- http://{BLOCKED}ward.com/images/logo.gif?27e4e=490218
- http://www.{BLOCKED}each.de/logo.gif?290cc=1176980
- http://{BLOCKED}anirakezen.nl/logo.gif?2a118=1206184
- http://{BLOCKED}anirakezen.nl/logo.gif?f099=307965
- http://www.{BLOCKED}des2013.unlugar.com/logo.gif?10598=334840
- http://www.{BLOCKED}rinternational.com/logo.gif?106c1=605385
- http://ngaoschool.{BLOCKED}c.th/logo.gif?108b5=203295
- http://{BLOCKED}uchoa.com/logos.gif?10de5=690930
- http://{BLOCKED}morales.com/logo.gif?11066=697340
- http://landmarkgroup.{BLOCKED}m.au/images/logos/logos.gif?112a8=562496
このウイルス情報は、自動解析システムにより作成されました。
対応方法
手順 1
Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。
手順 2
不明なレジストリ値を削除します。
警告:レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- Svc
- In HKEY_CURRENT_USER\Software\Afqteuv
- 1926745233
手順 3
このレジストリ値を削除します。
警告:レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- UacDisableNotify = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiVirusOverride = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiVirusDisableNotify = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirewallDisableNotify = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirewallOverride = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- UpdatesDisableNotify = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- UacDisableNotify = "1"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- GlobalUserOffline = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
- EnableLUA = "0"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- {malware path and file name} = "{malware path and file name}:*:enabled:ipsec"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- EnableFirewall = "0"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- DoNotAllowExceptions = "0"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- DisableNotifications = "1"
- In HKEY_CURRENT_USER\Software\Afqteuv\1926745233
- 1651272023 = "d6"
- In HKEY_CURRENT_USER\Software\Afqteuv\1926745233
- -992423250 = "0"
- In HKEY_CURRENT_USER\Software\Afqteuv\1926745233
- 658848773 = "0"
- In HKEY_CURRENT_USER\Software\Afqteuv\1926745233
- -1984846500 = "23"
- In HKEY_CURRENT_USER\Software\Afqteuv\1926745233
- -333574477 = "18a"
- In HKEY_CURRENT_USER\Software\Afqteuv\1926745233
- 1317697546 = "{random characters}"
- In HKEY_CURRENT_USER\Software\Afqteuv\1926745233
- -1325997727 = "{random characters}"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_0 = "c4a71155"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_0 = "2668"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_0 = "136a29"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_0 = "0"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_1 = "214f241a"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_1 = "626c7c6"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_1 = "636f37e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_1 = "626c6957"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_2 = "8ce9dcc"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_2 = "c4d8c9f3"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_2 = "c5dbb887"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_2 = "c4d8d2ae"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_3 = "222133a8"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_3 = "27452a7"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_3 = "2646562c"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_3 = "27453c5"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_4 = "12e1d213"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_4 = "89b1b3a"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_4 = "88b2cf75"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_4 = "89b1a55c"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_5 = "32611fd"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_5 = "ec1e19f"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_5 = "ed1d649a"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_5 = "ec1eeb3"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_6 = "c93775c"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_6 = "4e8a628d"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_6 = "4f891223"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_6 = "4e8a78a"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_7 = "faf7533c"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_7 = "bf6fd86"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_7 = "b1f58b48"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_7 = "bf6e161"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_8 = "3d63ed"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_8 = "13635c1f"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_8 = "126291"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_8 = "13634ab8"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_9 = "77e4c84b"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_9 = "75cfa94"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_9 = "74ccde26"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_9 = "75cfb4f"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_10 = "4395a939"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_10 = "d83c8c"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_10 = "d93f774f"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_10 = "d83c1d66"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_11 = "7bfa6e4"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_11 = "3aa89b4"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_11 = "3babec94"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_11 = "3aa886bd"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_12 = "1789941"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_12 = "9d14ed15"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_12 = "9c179a3d"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_12 = "9d14f14"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_13 = "ad4233e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_13 = "ff817ca1"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_13 = "fe823342"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_13 = "ff81596b"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_14 = "71538bb6"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_14 = "61ede257"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_14 = "6eea8eb"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_14 = "61edc2c2"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_15 = "6fe7c7c3"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_15 = "c45a3ad8"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_15 = "c559463"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_15 = "c45a2c19"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_16 = "ec2e9cd"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_16 = "26c6b5d9"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_16 = "27c5ff59"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_16 = "26c6957"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_17 = "cf14d29e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_17 = "8932e35a"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_17 = "883194ee"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_17 = "8932fec7"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_18 = "dcaaa5a"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_18 = "eb9f73f3"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_18 = "ea9c237"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_18 = "eb9f681e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_19 = "df8d99cb"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_19 = "4ebcb36"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_19 = "4f8bb5c"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_19 = "4ebd175"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_20 = "2d6499e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_20 = "b782311"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_20 = "b17b5e5"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_20 = "b783acc"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_21 = "d9d7797"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_21 = "12e4b395"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_21 = "13e7cea"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_21 = "12e4a423"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_22 = "4bdb6225"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_22 = "75511fd"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_22 = "74526753"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_22 = "7551d7a"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_23 = "db74b815"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_23 = "d7bd6fa2"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_23 = "d6be1cf8"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_23 = "d7bd76d1"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_24 = "f9e12eb"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_24 = "3a29fd4c"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_24 = "3b2a8a1"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_24 = "3a29e28"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_25 = "f15e1411"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_25 = "9c965cc2"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_25 = "9d952356"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_25 = "9c96497f"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_26 = "46c8c48b"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_26 = "ff2ad5f"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_26 = "fe1d8ff"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_26 = "ff2b2d6"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_27 = "4ce73274"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_27 = "616fb2e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_27 = "66c764"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_27 = "616f1c2d"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_28 = "e9731bdb"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_28 = "c3db9257"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_28 = "c2d8efad"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_28 = "c3db8584"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_29 = "37285e85"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_29 = "2647f5fb"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_29 = "274484f2"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_29 = "2647eedb"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_30 = "b166da8e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_30 = "88b44416"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_30 = "89b7321b"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_30 = "88b45832"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_31 = "71659f42"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_31 = "eb2e3fc"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_31 = "ea23aba"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_31 = "eb2c189"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_32 = "d29c38b9"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_32 = "4d8d33f"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_32 = "4c8e4c9"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_32 = "4d8d2ae"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_33 = "9e7b36e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_33 = "aff98c4d"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_33 = "aefafe1e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_33 = "aff99437"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_34 = "2dc776c"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_34 = "1265e56"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_34 = "136697a7"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_34 = "1265fd8e"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_35 = "df35a75b"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_35 = "74d27329"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_35 = "75d1ccc"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W4_35 = "74d266e5"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W1_36 = "e5b37cf7"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W2_36 = "d73ecf39"
- In HKEY_CURRENT_USER\Software\Afqteuv
- W3_36 = "d63dba15"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %Windows%\Explorer.EXE = "%Windows%\Explorer.EXE:*:Enabled:ipsec"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %System%\wscntfy.exe = "%System%\wscntfy.exe:*:Enabled:ipsec"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %User Temp%\winlvpxna.exe = "%User Temp%\winlvpxna.exe:*:Enabled:ipsec"
手順 4
変更されたレジストリ値を修正します。
警告:レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: Hidden = "2"
To: Hidden = ""2""
- From: Hidden = "2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiVirusOverride = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiVirusDisableNotify = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirewallDisableNotify = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirewallOverride = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- UpdatesDisableNotify = "1"
手順 5
以下のファイルを検索し削除します。
- %User Temp%\wh0jHTcRo6.ini
- %System%\drivers\iepqn.sys
- %User Temp%\winuocb.exe
- %User Temp%\winhume.exe
- %User Temp%\wucrr.exe
- %User Temp%\racxm.exe
- %User Temp%\xunj.exe
- %User Temp%\windxdi.exe
- %User Temp%\winlvpxna.exe
- %User Temp%\winmnprll.exe
- %User Temp%\winjugm.exe
- %User Temp%\wvkuw.exe
- %User Temp%\winxrxu.exe
- %User Temp%\winobllli.exe
- %User Temp%\nayno.exe
- %User Temp%\wincawyv.exe
- %User Temp%\winxhmmuh.exe
- %User Temp%\wincdycng.exe
- %User Temp%\lcps.exe
- %User Temp%\engfu.exe
- %User Temp%\cowqtw.exe
- %User Temp%\winjxaj.exe
- %User Temp%\qckqix.exe
- %User Temp%\winrwykx.exe
- %User Temp%\winintnw.exe
- %User Temp%\nfrrw.exe
- %User Temp%\hltgfo.exe
- %User Temp%\winecxo.exe
- %User Temp%\winmdux.exe
- %User Temp%\msjfnk.exe
- %User Temp%\ovpnn.exe
- %User Temp%\ufhl.exe
- %User Temp%\winwtumj.exe
- %User Temp%\winnrxx.exe
- %User Temp%\japqfe.exe
- %User Temp%\winajxvse.exe
- %User Temp%\winhvlwl.exe
- %User Temp%\tvjf.exe
- %User Temp%\svwfj.exe
- %User Temp%\winwurp.exe
- %User Temp%\wincgfn.exe
- %User Temp%\tqldv.exe
- %User Temp%\winiwrke.exe
- %User Temp%\winhevbo.exe
- %User Temp%\winrsgk.exe
- %User Temp%\csayu.exe
- %User Temp%\hrgw.exe
- %User Temp%\winwuexqw.exe
- %User Temp%\winjrery.exe
- %User Temp%\winjrxh.exe
- %User Temp%\winokogg.exe
- %User Temp%\winnyxgjw.exe
- %User Temp%\wingslqk.exe
- %User Temp%\winurmt.exe
- %User Temp%\qyqos.exe
- %User Temp%\winaobqq.exe
手順 6
最新のバージョン(エンジン、パターンファイル)を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「WORM_AUTORUN.LAS」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。
手順 7
以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア/グレイウェア/スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。
- %User Temp%\F1z5uX4958.ini
- %User Temp%\winmfys.exe
- %User Temp%\winakiof.exe
手順 8
以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。
※註:マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- AppMgmt
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Base
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Boot Bus Extender
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Boot file system
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- CryptSvc
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- DcomLaunch
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmadmin
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmboot.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmio.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmload.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- dmserver
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- EventLog
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- File system
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Filter
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- HelpSvc
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Netlogon
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- PCI Configuration
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- PlugPlay
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- PNP Filter
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- Primary disk
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- RpcSs
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- SCSI Class
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- sermouse.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- sr.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- SRService
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- System Bus Extender
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- vga.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- vgasave.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- WinMgmt
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {36FC9E60-C465-11CF-8056-444553540000}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E965-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E967-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E969-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E96A-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E96B-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E96F-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E977-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E97B-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E97D-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {4D36E980-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {71A27CDD-812A-11D0-BEC7-08002BE2092F}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
- Minimal
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- AFD
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- AppMgmt
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Base
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Boot Bus Extender
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Boot file system
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Browser
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- CryptSvc
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- DcomLaunch
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Dhcp
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmadmin
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmboot.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmio.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmload.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- dmserver
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- DnsCache
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- EventLog
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- File system
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Filter
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- HelpSvc
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- ip6fw.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- ipnat.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- LanmanServer
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- LanmanWorkstation
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- LmHosts
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Messenger
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NDIS
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NDIS Wrapper
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Ndisuio
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetBIOS
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetBIOSGroup
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetBT
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetDDEGroup
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Netlogon
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetMan
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
- Network
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NetworkProvider
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- NtLmSsp
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- PCI Configuration
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- PlugPlay
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- PNP Filter
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- PNP_TDI
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Primary disk
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- rdpcdd.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- rdpdd.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- rdpwd.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- rdsessmgr
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- RpcSs
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- SCSI Class
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- sermouse.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- SharedAccess
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- sr.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- SRService
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Streams Drivers
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- System Bus Extender
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- Tcpip
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- TDI
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- tdpipe.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- tdtcp.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- termservice
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- vga.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- vgasave.sys
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- WinMgmt
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- WZCSVC
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {36FC9E60-C465-11CF-8056-444553540000}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E965-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E967-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E969-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E96A-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E96B-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E96F-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E972-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E973-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E974-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E975-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E977-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E97B-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E97D-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {4D36E980-E325-11CE-BFC1-08002BE10318}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {71A27CDD-812A-11D0-BEC7-08002BE2092F}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
- Network
ご利用はいかがでしたか? アンケートにご協力ください