WORM_AUTORUN.USC

手順 1

Windows XP および Windows Server 2003 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

Windowsをセーフモードで再起動します。

手順 3

レジストリエディタおよびタスクマネージャ、フォルダオプションの機能を有効にします。

手順 4

このレジストリキーを削除します。

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

• In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
  • aic78en

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  • Run

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
  • Run

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • 360rpt.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • 360Safe.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • 360tray.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • adam.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • AgentSvr.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • AppSvc32.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • AST.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • autoruns.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • avgrssvc.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • AvMonitor.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • avp.com

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • avp.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • CCenter.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • ccSvcHst.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • FileDsty.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • FTCleanerShell.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • HijackThis.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • IceSword.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • iparmo.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • Iparmor.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • isPwdSvc.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • kabaload.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KaScrScn.SCR

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KASMain.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KASTask.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KAV32.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KAVDX.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KAVPFW.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KAVSetup.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KAVStart.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KISLnchr.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KMailMon.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KMFilter.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KPFW32.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KPFW32X.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KPFWSvc.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KRegEx.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • krepair.COM

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KsLoader.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KVCenter.kxp

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KvDetect.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KvfwMcl.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KVMonXP.kxp

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KVMonXP_1.kxp

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • kvol.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • kvolself.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KvReport.kxp

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KVScan.kxp

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KVSrvXP.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KVStub.kxp

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • kvupload.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • kvwsc.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KvXP.kxp

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KvXP_1.kxp

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KWatch.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KWatch9x.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • KWatchX.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • loaddll.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • MagicSet.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • mcconsol.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • mmqczj.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • mmsk.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • NAVSetup.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • nod32krn.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • nod32kui.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • PFW.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • PFWLiveUpdate.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • QHSET.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • Ras.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • Rav.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • RavMon.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • RavMonD.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • RavStub.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • RavTask.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • RegClean.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • rfwcfg.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • RfwMain.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • rfwProxy.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • rfwsrv.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • RsAgent.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • Rsaupd.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • runiep.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • safelive.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • scan32.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • shcfg32.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • SmartUp.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • SREng.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • symlcsvc.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • SysSafe.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • TrojanDetector.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • Trojanwall.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • TrojDie.kxp

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • UIHost.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • UmxAgent.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • UmxAttachment.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • UmxCfg.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • UmxFwHlp.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • UmxPol.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • UpLive.EXE.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • WoptiClean.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • zxsweep.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • RSTray.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • regedit.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • regedit.com

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • regedit.com

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • regedit.com

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • regedit.com

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • regedit.com

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • regedit.com

• In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}
  • Control

• In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
  • {248DD890-BB45-11CF-9ABC-0080C7E7B78D}

• In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0
  • 0

手順 5

このレジストリ値を削除します。

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • MaxBSLoad = "%System%\TIMPlatform.exe"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • Winlogon = "%Windows%\winlogon.exe"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
  • inetinfo = "%Windows%\inetinfo.exe"

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78en
  • DependOnService = "DHCP System Application"

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78en
  • Description = "{random characters}"

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78en
  • DisplayName = "DHCP Service"

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78en
  • ImagePath = "%Program Files%\Common Files\Microsoft Shared\MSInfo\msinfo16h.exe"

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78en
  • ObjectName = "LocalSystem"

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78en
  • ErrorControl = "1"

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78en
  • Start = "2"

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78en
  • Type = "2"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krepair.COM
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.com
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.com
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.com
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.com
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.com
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.com
  • DEBUGGER = "%Program Files%\Internet Explorer\JSPdebuggercom.dll"

手順 6

変更されたレジストリ値を修正します。

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

• In HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
  • load = "%Windows%\inf\realplayer.exe"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
  • From: CheckedValue = "3"
    To: CheckedValue = ""1""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32
  • From: ThreadingModel = "Apartment"
    To: ThreadingModel = ""Apartment""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib
  • From: Version = "1.0"
    To: Version = ""1.0""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib
  • From: Version = "1.0"
    To: Version = ""1.0""

手順 7

以下のファイルを検索し削除します。

• %Windows%\ctfmon.exe
• %Windows%\inetinfo.exe
• %Windows%\winlogon.exe
• %System%\TIMPlatform.exe
• %Windows%\inf\realplayer.exe
• %Program Files%\Common Files\Microsoft Shared\MSInfo\msinfo16h.exe
• %Program Files%\Internet Explorer\JSPdebuggercom.dll
• A:\AUTOEXEC.EXE
• A:\AutoRun.inf
• %System Root%\AUTOEXEC.EXE
• %System Root%\AutoRun.inf
• %System%\1186_xmk.ole

手順 8

コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「WORM_AUTORUN.USC」と検出したファイルの検索を実行してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 9

以下のファイルをバックアップを用いて修復します。マイクロソフト製品に関連したファイルのみに修復されます。このマルウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

• %System%\drivers\etc\hosts

手順 10

以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。

※註：マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E967-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
  • {4D36E967-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
  • {248DD896-BB45-11CF-9ABC-0080C7E7B78D}

• In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
  • {248DD897-BB45-11CF-9ABC-0080C7E7B78D}