BKDR_PUSHDO.QW

2013年11月16日

解析者: Nikko Tamana

プラットフォーム:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

危険度:

ダメージ度:

感染力:

感染確認数:

情報漏えい:

マルウェアタイプ: バックドア型
破壊活動の有無: なし
暗号化:
感染報告の有無: はい

概要

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

詳細

ファイルサイズ 96,256 bytes

タイプ EXE

メモリ常駐はい

発見日 2013年10月22日

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、感染したコンピュータ内に以下のように自身のコピーを作成します。

%User Profile%\{random filename}.exe

(註：%User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞" です。)

自動実行方法

マルウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random filename} = "%User Profile%\{random filename}.exe"

他のシステム変更

マルウェアは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
AppManagement = "{random value}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
{random filename} = "{random value}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
{random number} = "{random value}"

HKEY_CURRENT_USER\Software\WinRAR
HWID = "{random value}"

HKEY_CURRENT_USER\Software\WinRAR
Client Hash = "{random value}"

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

{BLOCKED}p.com
{BLOCKED}chitectural.com
{BLOCKED}derwriters.com
{BLOCKED}d.org
{BLOCKED}l.lt
{BLOCKED}investor.ca
{BLOCKED}ba.com.br
{BLOCKED}owledgements.net
{BLOCKED}pacificrepairs.com
{BLOCKED}actory.net
{BLOCKED}nfire.com
{BLOCKED}tehaus-sylt.de
{BLOCKED}liatedinc.com
{BLOCKED}ce-des-druides.com
{BLOCKED}rno.ru
{BLOCKED}ise.com
{BLOCKED}andertg.com
{BLOCKED}.gmail-smtp-in.l.google.com
{BLOCKED}nhousehotel.com
{BLOCKED}sciatorivenezia.com
{BLOCKED}lemails.com
{BLOCKED}service.com
{BLOCKED}lfarm.org
{BLOCKED}iplan.cl
{BLOCKED}epesajandek.hu
{BLOCKED}iteturadigital.com
{BLOCKED}co.jp
{BLOCKED}asli.com
{BLOCKED}risk.com.sg
{BLOCKED}rgo.com
{BLOCKED}saviationinc.com
{BLOCKED}ence-web.net
{BLOCKED}o-direkt.net
{BLOCKED}ardener.com.au
{BLOCKED}t-ime.com
{BLOCKED}ay.com
{BLOCKED}cusa.com
{BLOCKED}s1st.com
{BLOCKED}vigna.com
{BLOCKED}ia.net
{BLOCKED}tl.net
{BLOCKED}isj.com
{BLOCKED}techinc.com
{BLOCKED}bala.com
{BLOCKED}ohnsbeefjerky.com
{BLOCKED}opmultimedia.com
{BLOCKED}.in
{BLOCKED}ornet.se
{BLOCKED}mat.biz
{BLOCKED}orangegames.com
{BLOCKED}phoenixmedia.com
{BLOCKED}gaantigal.com
{BLOCKED}.net
{BLOCKED}tlehouse.com
{BLOCKED}taviation.com
{BLOCKED}india.com
{BLOCKED}dland.com.au
{BLOCKED}ad.com
{BLOCKED}killmedia.com
{BLOCKED}du.com
{BLOCKED}oseonline.com
{BLOCKED}mccall.com
{BLOCKED}arygreer.org
{BLOCKED}ep.org
{BLOCKED}ingdelaplage.com
{BLOCKED}talcitytuxedo.com
{BLOCKED}bbean-mercy.org
{BLOCKED}behair.com
{BLOCKED}iweb.com
{BLOCKED}iereurope.be
{BLOCKED}copias.com.br
{BLOCKED}imp.com.br
{BLOCKED}4choice.org
{BLOCKED}rinting.com.au
{BLOCKED}i.com
{BLOCKED}bikalip.com.tr
{BLOCKED}england.com
{BLOCKED}lescrail.com
{BLOCKED}dscope.com
{BLOCKED}ce-select.com
{BLOCKED}reative.com
{BLOCKED}chsupplies.net
{BLOCKED}rcutautoglass.com
{BLOCKED}asite.com
{BLOCKED}pku.edu.cn
{BLOCKED}th.com
{BLOCKED}arsia.com
{BLOCKED}raining.cl
{BLOCKED}ellodeboveda.com
{BLOCKED}inentaldental.com
{BLOCKED}ina.com
{BLOCKED}c.de
{BLOCKED}erstonestatebank.com
{BLOCKED}pinshouse.org
{BLOCKED}c.org
{BLOCKED}process.org
{BLOCKED}om
{BLOCKED}rcove.com
{BLOCKED}b.net
{BLOCKED}orin-kaku.com
{BLOCKED}nesclub.com
{BLOCKED}um.org
{BLOCKED}svill.org
{BLOCKED}mponents.com
{BLOCKED}rescueusa.com
{BLOCKED}nomn.us
{BLOCKED}vto.ru
{BLOCKED}arcaregiver.org
{BLOCKED}clinic.com
{BLOCKED}ngfa.com
{BLOCKED}ro.se
{BLOCKED}rgrafic.com
{BLOCKED}d.com
{BLOCKED}medya.com
{BLOCKED}opyxpress.com
{BLOCKED}stymining.com
{BLOCKED}uukyaku.com
{BLOCKED}penntest.com
{BLOCKED}gen.com
{BLOCKED}stds.org
{BLOCKED}persyst.com
{BLOCKED}entadesign.co.uk
{BLOCKED}rdalia.com
{BLOCKED}n.wx4akq.org
{BLOCKED}ro-stewards.com
{BLOCKED}.net
{BLOCKED}tsupply.com
{BLOCKED}cles.com
{BLOCKED}sia.it
{BLOCKED}roup.com
{BLOCKED}inn.is
{BLOCKED}archofamerica.com
{BLOCKED}withus.net
{BLOCKED}hercorp.com
{BLOCKED}chersgifts.com
{BLOCKED}idadoubled.com
{BLOCKED}koma.com
{BLOCKED}er-high.school.nz
{BLOCKED}erickallergy.com
{BLOCKED}patentauction.com
{BLOCKED}uet.com
{BLOCKED}lt
{BLOCKED}ielramosehijos.com
{BLOCKED}.net
{BLOCKED}lingonlinemagazine.com
{BLOCKED}cpa.com
{BLOCKED}ois.com
{BLOCKED}ap.com
{BLOCKED}alairservice.com
{BLOCKED}l-smtp-in.l.google.com
{BLOCKED}coursemarketing.com
{BLOCKED}valuecenter.com
{BLOCKED}ur.com.br
{BLOCKED}ntrain.coop
{BLOCKED}nearthholidays.com
{BLOCKED}nlightpm.com
{BLOCKED}sautobody.com
{BLOCKED}multimedia.com
{BLOCKED}ell.com.au
{BLOCKED}d.k12.ca.us
{BLOCKED}omare.nl
{BLOCKED}enwave.net
{BLOCKED}outinc.com
{BLOCKED}ltennis.com
{BLOCKED}rdjohnson.net
{BLOCKED}.co.uk
{BLOCKED}u.com
{BLOCKED}services.com
{BLOCKED}india.com
{BLOCKED}ep.com
{BLOCKED}-cons.com
{BLOCKED}ono.net
{BLOCKED}s.fr
{BLOCKED}org.pe
{BLOCKED}strazioni.net
{BLOCKED}inethatinc.com
{BLOCKED}smtp.messagingengine.com
{BLOCKED}a-seikatu.com
{BLOCKED}aneye.in
{BLOCKED}atimes.com.didtheyreadit.com
{BLOCKED}x.ca
{BLOCKED}lliworks.com.au
{BLOCKED}lsysco.com
{BLOCKED}rvantage.com
{BLOCKED}stint.com
{BLOCKED}-karnataka.org
{BLOCKED}h.com
{BLOCKED}actor.com
{BLOCKED}kutilities.com
{BLOCKED}encorp.com
{BLOCKED}iesfund.org.uk
{BLOCKED}com.au
{BLOCKED}usic.nl
{BLOCKED}connect.co.za
{BLOCKED}it.com
{BLOCKED}stocracy.org
{BLOCKED}chanona.com
{BLOCKED}oshop.com
{BLOCKED}nbishopentertainment.com
{BLOCKED}chigroup.com
{BLOCKED}.net.pl
{BLOCKED}shi-hp.com
{BLOCKED}ker.com
{BLOCKED}cci.or.jp
{BLOCKED}telier.com
{BLOCKED}ariage.com
{BLOCKED}ershipforum.us
{BLOCKED}uridica.com
{BLOCKED}rationyoga.com
{BLOCKED}orth.com
{BLOCKED}-online-poker-game.com
{BLOCKED}erlookz.com
{BLOCKED}etic.com
{BLOCKED}kirjat.com
{BLOCKED}computer.hu
{BLOCKED}o.co.uk
{BLOCKED}regor.co.kr
{BLOCKED}star.com
{BLOCKED}c3.net
{BLOCKED}ai.com
{BLOCKED}.airmail.net
{BLOCKED}57.us2.mcsv.net
{BLOCKED}7.digitalwaves.co.nz
{BLOCKED}chimp.com
{BLOCKED}gacorp.com
{BLOCKED}asur.com
{BLOCKED}attanarts.org
{BLOCKED}yantralaya.com
{BLOCKED}usgrimes.co.uk
{BLOCKED}el.ch
{BLOCKED}exco.com
{BLOCKED}inezmoya-abogados.com
{BLOCKED}echn.com
{BLOCKED}ergrp-spb.ru
{BLOCKED}nneyinsurance.com
{BLOCKED}bemarine.com
{BLOCKED}22.net
{BLOCKED}dies.org
{BLOCKED}estga.com
{BLOCKED}burns.com
{BLOCKED}gui.com
{BLOCKED}inikos.com
{BLOCKED}lub.ru
{BLOCKED}car-vacaciones.com
{BLOCKED}n.com
{BLOCKED}lp.com
{BLOCKED}ys.com
{BLOCKED}mail.ru
{BLOCKED}eapcoupons.com
{BLOCKED}lecenter.com
{BLOCKED}agurus.com
{BLOCKED}onalwallcovering.com
{BLOCKED}apictures.com
{BLOCKED}venementiel.com
{BLOCKED}pro.com.tw
{BLOCKED}atrixsolutions.com
{BLOCKED}paperdrive.com
{BLOCKED}daysiteng.com
{BLOCKED}edictionary.com
{BLOCKED}ary.nazwa.pl
{BLOCKED}y.com.cn
{BLOCKED}nredshaw.co.uk
{BLOCKED}hdakotapreps.com
{BLOCKED}p.co.jp
{BLOCKED}as.cz
{BLOCKED}n-networks.net
{BLOCKED}ji-school.com
{BLOCKED}mek.com.tr
{BLOCKED}tball.be
{BLOCKED}icialryan.com
{BLOCKED}u.com
{BLOCKED}ys-cove.com
{BLOCKED}uinamusement.com
{BLOCKED}otype.com
{BLOCKED}.ba
{BLOCKED}ame.com
{BLOCKED}che-valencia.com
{BLOCKED}.ca
{BLOCKED}isionorganizing.com
{BLOCKED}tart-adc.com
{BLOCKED}pecindustries.com
{BLOCKED}ak.org
{BLOCKED}omail.com
{BLOCKED}nstackwarehouse.com.au
{BLOCKED}myride.com
{BLOCKED}.net
{BLOCKED}cz
{BLOCKED}akefield.co.uk
{BLOCKED}soft.ru
{BLOCKED}propertyservices.us
{BLOCKED}oneretreat.com
{BLOCKED}oebius.com
{BLOCKED}rdhits.com
{BLOCKED}c.ca
{BLOCKED}edia.ru
{BLOCKED}rtconti.com
{BLOCKED}estercathedral.org
{BLOCKED}oshow.com.au
{BLOCKED}inacoiffure.com
{BLOCKED}s.net
{BLOCKED}hdavid.com
{BLOCKED}nacompany.com
{BLOCKED}ng-japan.com
{BLOCKED}nto.com
{BLOCKED}tishpolicecu.co.uk
{BLOCKED}.ie
{BLOCKED}tite.com
{BLOCKED}amu.com
{BLOCKED}door.pl
{BLOCKED}ico-ind.com
{BLOCKED}eyspizza.ph
{BLOCKED}ltile.com
{BLOCKED}eliteexpress.com
{BLOCKED}sales.co.uk
{BLOCKED}ya.net
{BLOCKED}.compuserve.com
{BLOCKED}.directcon.net
{BLOCKED}.live.com
{BLOCKED}.mail.yahoo.com
{BLOCKED}.sbcglobal.yahoo.com
{BLOCKED}ex.es
{BLOCKED}ub.com
{BLOCKED}tioncorp.com
{BLOCKED}edorganizing.com
{BLOCKED}z.kharkov.ua
{BLOCKED}advertising.com
{BLOCKED}group.com
{BLOCKED}i.org
{BLOCKED}cehere.tv
{BLOCKED}ckaginggroup.com
{BLOCKED}media.ca
{BLOCKED}mundsnscc.com
{BLOCKED}lpennygames.com
{BLOCKED}net.de
{BLOCKED}kings-dating.com
{BLOCKED}-ddos.me
{BLOCKED}ru.it
{BLOCKED}rasilrp.com.br
{BLOCKED}erlandsound.com
{BLOCKED}tka.com
{BLOCKED}rtufi.com
{BLOCKED}hiplan.com
{BLOCKED}ual.com
{BLOCKED}ryildirim.net
{BLOCKED}on.com
{BLOCKED}ing-video.com
{BLOCKED}etron.com
{BLOCKED}ole.com
{BLOCKED}alab.com.tr
{BLOCKED}ico.com
{BLOCKED}decal.com
{BLOCKED}rtofhair.com
{BLOCKED}atcave.org.uk
{BLOCKED}ardenctr.com
{BLOCKED}asmusforum.com
{BLOCKED}ergery.com
{BLOCKED}aterwaystrust.com
{BLOCKED}asdbrown.com
{BLOCKED}connect.pl
{BLOCKED}hacademy.org
{BLOCKED}learthcare.com.au
{BLOCKED}enmeuse.com
{BLOCKED}amura.com
{BLOCKED}k7.org
{BLOCKED}ity-works.com
{BLOCKED}org
{BLOCKED}-a-round.com
{BLOCKED}feplanning.com
{BLOCKED}ele-roysakuma.com
{BLOCKED}dsu.org
{BLOCKED}edearthgroup.com
{BLOCKED}lon89.com
{BLOCKED}tiaproject.com
{BLOCKED}hosting.com
{BLOCKED}uardpkg.com
{BLOCKED}.com
{BLOCKED}ipharm.de
{BLOCKED}oria.com.pl
{BLOCKED}yakumar.org
{BLOCKED}aggiosancarlo.it
{BLOCKED}rma.com
{BLOCKED}lur.by
{BLOCKED}.org
{BLOCKED}towall.se
{BLOCKED}rproofcharters.com
{BLOCKED}news.com
{BLOCKED}hillsstl.org
{BLOCKED}xecutiveservice.com
{BLOCKED}rosemarketing.com
{BLOCKED}nsfieldhockey.com
{BLOCKED}owerontheweb.com
{BLOCKED}sure.com
{BLOCKED}avant-ime.com
{BLOCKED}bigjohnsbeefjerky.com
{BLOCKED}childscope.com
{BLOCKED}chscreative.com
{BLOCKED}eygwindows.co.uk
{BLOCKED}hpp-services.com
{BLOCKED}ixtractor.com
{BLOCKED}justconnect.co.za
{BLOCKED}mibsga.com
{BLOCKED}myfilecenter.com
{BLOCKED}patentauction.com
{BLOCKED}rodeoshow.com.au
{BLOCKED}saios.net
{BLOCKED}servico-ind.com
{BLOCKED}solutioncorp.com
{BLOCKED}teknorhino.com
{BLOCKED}theartofhair.com
{BLOCKED}traderush.com
{BLOCKED}vanguardpkg.com
{BLOCKED}llcommunications.de
{BLOCKED}xiao.com
{BLOCKED}moto-sr.com
{BLOCKED}oomla.com
{BLOCKED}o.com
{BLOCKED}barbatului.ro

対応方法

対応検索エンジン: 9.300

初回 VSAPI パターンバージョン 10.400.04

初回 VSAPI パターンリリース日 2013年11月9日

VSAPI OPR パターンバージョン 10.401.00

VSAPI OPR パターンリリース日 2013年11月10日

手順 1

Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

このマルウェアのパス名およびファイル名を確認します。
最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用いてウイルス検索を実行してください。「BKDR_PUSHDO.QW」で検出したパス名およびファイル名を確認し、メモ等をとってください。

手順 3

Windowsをセーフモードで再起動します。

[ 詳細 ]

手順 4

このレジストリ値を削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- {random filename} = "%User Profile%\{random filename}.exe"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
- AppManagement = "{random value}"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
- {random filename} = "{random value}"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
- {random number} = "{random value}"
In HKEY_CURRENT_USER\Software\WinRAR
- HWID = "{random value}"
In HKEY_CURRENT_USER\Software\WinRAR
- Client Hash = "{random value}"

手順 5

コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「BKDR_PUSHDO.QW」と検出したファイルの検索を実行してください。検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

ご利用はいかがでしたか？　アンケートにご協力ください