Trend Micro Security

TROJ_PAM_000005043E.T3

2012年10月13日
 別名:

Trojan.ADH.2 (Symantec); ARC:NSIS, PAK:[$PLUGINSDIR\md5dll.dll]:UPX, ARC:[funmoods.exe]:NSIS, ARC:[funmoods.exe/data0006]:ZIP (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt)

 プラットフォーム:

Windows 2000, Windows XP, Windows Server 2003

 危険度:
 ダメージ度:
 感染力:
 感染確認数:


  • マルウェアタイプ: トロイの木馬型
  • 破壊活動の有無: なし
  • 暗号化:  
  • 感染報告の有無: はい

  概要


マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 1,869,408 bytes
タイプ EXE
メモリ常駐 なし
発見日 2012年7月20日

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のフォルダを作成します。

  • %System Root%\Documents and Settings\Wilbert
  • %System Root%\DOCUME~1
  • %System Root%\DOCUME~1\Wilbert
  • %User Profile%\LOCALS~1
  • %User Temp%\nsa2.tmp
  • %User Temp%\nsz4.tmp
  • %Program Files%\Mozilla Firefox
  • %Program Files%\Mozilla Firefox\extensions
  • %Program Files%\Mozilla Firefox\searchplugins
  • %User Temp%\FNMD
  • %User Temp%\FNMD\FM
  • %User Temp%\FNMD\FM\1.5.11.16
  • %User Temp%\nsn6.tmp
  • %Program Files%\Funmoods
  • %Program Files%\Funmoods\funmoods
  • %Program Files%\Funmoods\funmoods\1.5.11.16
  • %Program Files%\Funmoods\funmoods\1.5.11.16\bh
  • %User Temp%\nsd8.tmp
  • %User Temp%\mt_ffx
  • %User Temp%\mt_ffx\Funmoods
  • %User Temp%\mt_ffx\Funmoods\funmoods
  • %User Temp%\mt_ffx\Funmoods\funmoods\1.5.11.16

(註：%System Root%は、標準設定では "C:" です。また、オペレーティングシステムが存在する場所です。. %User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。. %User Temp%はWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 98 および MEの場合、"C:\Windows\Temp"、Windows NT の場合、"C:\Profiles\＜ユーザー名＞\TEMP"、Windows 2000、XP、Server 2003 の場合、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\TEMP" です。. %Program Files%は、標準設定では "C:\Program Files" です。)

自動実行方法

マルウェアは、以下のレジストリキーを追加し、自身をBrowser Helper Object（BHO）として登録します。これにより、Internet Explorer（IE）が起動するとマルウェアが自動実行されます。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}

他のシステム変更

マルウェアは、以下のファイルを削除します。

  • %User Temp%\nsy1.tmp
  • %User Temp%\nsa2.tmp
  • %User Temp%\nsj3.tmp
  • %User Temp%\nsz4.tmp
  • %User Temp%\nsm5.tmp
  • %User Temp%\nsn6.tmp
  • %User Temp%\nsy7.tmp
  • %User Temp%\nsd8.tmp

(註：%User Temp%はWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 98 および MEの場合、"C:\Windows\Temp"、Windows NT の場合、"C:\Profiles\＜ユーザー名＞\TEMP"、Windows 2000、XP、Server 2003 の場合、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\TEMP" です。)

マルウェアは、以下のレジストリキーを追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
funmoods.funmoodsHlpr\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
funmoods.funmoodsHlpr\CurVer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\VersionIndependentProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\Programmable

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\InprocServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\escortApp.DLL

HKEY_CLASSES_ROOT\funmoodsApp.appCore.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
funmoodsApp.appCore.1\CLSID

HKEY_CLASSES_ROOT\funmoodsApp.appCore

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
funmoodsApp.appCore\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
funmoodsApp.appCore\CurVer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\VersionIndependentProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\Programmable

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\InprocServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\
FLAGS

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\
0\win32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\
HELPDIR

HKEY_CLASSES_ROOT\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\
Instl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0\
FLAGS

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0\
0\win32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0\
HELPDIR

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\escortEng.DLL

HKEY_CLASSES_ROOT\f

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
f\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
f\CurVer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\VersionIndependentProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\Programmable

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\InprocServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\TypeLib

HKEY_CLASSES_ROOT\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\
instl\dfltLng

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
funmoods

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\esrv.EXE

HKEY_CLASSES_ROOT\esrv.funmoodsESrvc.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
esrv.funmoodsESrvc.1\CLSID

HKEY_CLASSES_ROOT\esrv.funmoodsESrvc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
esrv.funmoodsESrvc\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
esrv.funmoodsESrvc\CurVer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\VersionIndependentProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\Programmable

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\LocalServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\
FLAGS

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\
0

HKEY_CURRENT_USER\Software\Funmoods\
funmoods\Instl\Install

HKEY_LOCAL_MACHINE\Software\Funmoods\
funmoods\Instl\Install

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\escorTlbr.DLL

HKEY_CLASSES_ROOT\funmoods.dskBnd.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
funmoods.dskBnd.1\CLSID

HKEY_CLASSES_ROOT\funmoods.dskBnd

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
funmoods.dskBnd\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
funmoods.dskBnd\CurVer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\VersionIndependentProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\Programmable

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\InprocServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\
FLAGS

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\
0\win32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\
HELPDIR

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{C87FC351-A80D-43E9-9A86-CF1E29DC443A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\escort.DLL

HKEY_CLASSES_ROOT\escort.escortIEPane.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
escort.escortIEPane.1\CLSID

HKEY_CLASSES_ROOT\escort.escortIEPane

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
escort.escortIEPane\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
escort.escortIEPane\CurVer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\VersionIndependentProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\
0\win32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\
HELPDIR

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\Programmable

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\InprocServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\TypeLib

HKEY_CLASSES_ROOT\funmoods.funmoodsHlpr.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
funmoods.funmoodsHlpr.1\CLSID

HKEY_CLASSES_ROOT\funmoods.funmoodsHlpr

マルウェアは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Funmoods\
funmoods\Instl\Install
Start Page = "http://www.{BLOCKED}oft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\AboutURLs
Tabs = "http://start.{BLOCKED}ds.com/?f=2&a=down"

HKEY_LOCAL_MACHINE\SOFTWARE\Funmoods\
funmoods\Instl\Install
SearchAssistant = "http://ie.{BLOCKED}h.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

HKEY_LOCAL_MACHINE\SOFTWARE\Funmoods\
funmoods\Instl\Install
Use Custom Search URL = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Use Custom Search URL = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}
URL = "http://start.{BLOCKED}ds.com/?a=down&s={searchTerms}&f=4"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}
DisplayName = "Search"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes
DefaultScope = "{0D7562AE-8EF6-416d-A838-AB665251703A}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\escorTlbr.DLL
AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\InprocServer32
ThreadingModel = "apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Toolbar
{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} = "Funmoods Toolbar"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{C87FC351-A80D-43E9-9A86-CF1E29DC443A}
Policy = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{C87FC351-A80D-43E9-9A86-CF1E29DC443A}
AppName = "funmoodssrv.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{C87FC351-A80D-43E9-9A86-CF1E29DC443A}
AppPath = "%Program Files%\Funmoods\funmoods\1.5.11.16"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
NoExplorer = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\escort.DLL
AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\InprocServer32
ThreadingModel = "apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}
AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\InprocServer32
ThreadingModel = "apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\escortApp.DLL
AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\InprocServer32
ThreadingModel = "apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}
AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data
hrdId = "68ad0fd00000000000000050569c013f"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data
instlDay = "3c6d"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\escortEng.DLL
AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\InprocServer32
ThreadingModel = "apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data
vrsni = "1.5.11.16"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data
afltId = "down"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data
aflt = "down"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data
smplGrp = "none"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data
tlbrId = "base"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data
vrsnTs = "1.5.11.161:10:56"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\
Data
tlbrSrchUrl = "http://start.{BLOCKED}ds.com/results.php?f=3&a=down&q="

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki
path = "%Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx"

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki
version = "1.4.5"

HKEY_LOCAL_MACHINE\SOFTWARE\Funmoods\
funmoods\Instl
InstallDir = "%Program Files%\Funmoods\funmoods\1.5.11.16"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
funmoods
DisplayName = "Funmoods on IE and Chrome"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
funmoods
UninstallString = "%Program Files%\Funmoods\funmoods\1.5.11.16\uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
funmoods
DisplayIcon = "%Program Files%\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
funmoods
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
funmoods
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\esrv.EXE
AppID = "{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\LocalServer32
ThreadingModel = "apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
AppID = "{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}"

マルウェアは、以下のレジストリ値を変更します。

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "http://start.{BLOCKED}ds.com/?f=1&a=down"

(註：変更前の上記レジストリ値は、「http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Search
SearchAssistant = "http://start.{BLOCKED}ds.com/results.php?f=4&a=down&q={searchTerms}"

(註：変更前の上記レジストリ値は、「http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm」となります。)

作成活動

マルウェアは、以下のファイルを作成します。

  • %Application Data%\funmoods.exe
  • %Application Data%\facemoods.bmp
  • %Application Data%\dealply.bmp
  • %Application Data%\bloson.bmp
  • %Application Data%\lateral1.bmp
  • %Application Data%\lateral2.bmp
  • %Application Data%\lateral3.bmp
  • %User Temp%\nsa2.tmp\LangDLL.dll
  • %User Temp%\nsa2.tmp\nsRandom.dll
  • %User Temp%\nsa2.tmp\System.dll
  • %User Temp%\nsa2.tmp\modern-header.bmp
  • %User Temp%\nsa2.tmp\nsDialogs.dll
  • %User Temp%\nsa2.tmp\inetc.dll
  • %Application Data%\temp.u2d
  • %User Temp%\nsa2.tmp\md5dll.dll
  • %Application Data%\optimizador-condor-3.0.zip
  • %User Temp%\nsz4.tmp\UserInfo.dll
  • %User Temp%\nsz4.tmp\System.dll
  • %User Temp%\nsz4.tmp\nsisos.dll
  • %User Temp%\nsz4.tmp\mt.dll
  • %User Temp%\nsz4.tmp\Time.dll
  • %User Temp%\nsz4.tmp\Processes.dll
  • %User Temp%\FNMD\FM\1.5.11.16\FM4ffx.exe
  • %User Temp%\FNMD\FM\1.5.11.16\FM4ie.exe
  • %User Temp%\nsz4.tmp\InetLoad.dll
  • %User Temp%\FNMD\FM\1.5.11.16\nsis.js
  • %User Temp%\nsz4.tmp\NSISdl.dll
  • %User Temp%\nsm9.tmp
  • %User Temp%\nsn6.tmp\UserInfo.dll
  • %User Temp%\nsn6.tmp\System.dll
  • %User Temp%\nsn6.tmp\nsisos.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\bh\funmoods.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsApp.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsEng.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsTlbr.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx
  • %Program Files%\Funmoods\funmoods\1.5.11.16\uninstall.exe
  • %User Temp%\nsd8.tmp\nsisos.dll
  • %User Temp%\nsd8.tmp\System.dll
  • %User Temp%\nsd8.tmp\mt.dll
  • %User Temp%\nsd8.tmp\Time.dll

(註：%Application Data%フォルダは、 Windows 2000、XP、Server 2003 の場合 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" 、 Windows NTの場合 "C:\WINNT\Profiles\＜ユーザ名＞\Application Data"、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞\Application Data" です。. %User Temp%はWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 98 および MEの場合、"C:\Windows\Temp"、Windows NT の場合、"C:\Profiles\＜ユーザー名＞\TEMP"、Windows 2000、XP、Server 2003 の場合、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\TEMP" です。. %Program Files%は、標準設定では "C:\Program Files" です。)

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

  • http://www.{BLOCKED}wn.com/dm/control.txt
  • http://www.{BLOCKED}wn.com/dm/date.txt
  • http://www.{BLOCKED}wn.com/{random path}
  • http://reports.{BLOCKED}ra.com/reports/jsRprt.srf?{random characters}

このウイルス情報は、自動解析システムにより作成されました。

  対応方法

対応検索エンジン: 9.200

手順 1

Windows XP および Windows Server 2003 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

起動中ブラウザのウインドウを全て閉じてください。

手順 3

このレジストリキーを削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Funmoods\funmoods\Instl
    • Install
  • In HKEY_LOCAL_MACHINE\Software\Funmoods\funmoods\Instl
    • Install
  • In HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
    • {0D7562AE-8EF6-416d-A838-AB665251703A}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • {4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • escorTlbr.DLL
  • In HKEY_CLASSES_ROOT
    • funmoods.dskBnd.1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\funmoods.dskBnd.1
    • CLSID
  • In HKEY_CLASSES_ROOT
    • funmoods.dskBnd
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\funmoods.dskBnd
    • CLSID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\funmoods.dskBnd
    • CurVer
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
    • {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
    • ProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
    • VersionIndependentProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
    • Programmable
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
    • InprocServer32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
    • {4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
    • 1.0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0
    • FLAGS
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0
    • 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\0
    • win32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0
    • HELPDIR
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy
    • {C87FC351-A80D-43E9-9A86-CF1E29DC443A}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • {09C554C3-109B-483C-A06B-F14172F1A947}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • escort.DLL
  • In HKEY_CLASSES_ROOT
    • escort.escortIEPane.1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane.1
    • CLSID
  • In HKEY_CLASSES_ROOT
    • escort.escortIEPane
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane
    • CLSID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane
    • CurVer
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
    • {965B9DBE-B104-44AC-950A-8A5F97AFF439}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}
    • ProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}
    • VersionIndependentProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}
    • Programmable
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}
    • InprocServer32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}
    • TypeLib
  • In HKEY_CLASSES_ROOT
    • funmoods.funmoodsHlpr.1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr.1
    • CLSID
  • In HKEY_CLASSES_ROOT
    • funmoods.funmoodsHlpr
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr
    • CLSID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr
    • CurVer
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
    • {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
    • ProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
    • VersionIndependentProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
    • Programmable
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
    • InprocServer32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • {D7EE8177-D51E-4F89-92B6-83EA2EC40800}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • escortApp.DLL
  • In HKEY_CLASSES_ROOT
    • funmoodsApp.appCore.1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\funmoodsApp.appCore.1
    • CLSID
  • In HKEY_CLASSES_ROOT
    • funmoodsApp.appCore
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\funmoodsApp.appCore
    • CLSID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\funmoodsApp.appCore
    • CurVer
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
    • {A9DB719C-7156-415E-B49D-BAD039DE4F13}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}
    • ProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}
    • VersionIndependentProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}
    • Programmable
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}
    • InprocServer32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
    • {D7EE8177-D51E-4F89-92B6-83EA2EC40800}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
    • 1.0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0
    • FLAGS
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0
    • 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0
    • win32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0
    • HELPDIR
  • In HKEY_CLASSES_ROOT\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
    • Instl
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl
    • Data
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
    • {1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}
    • 1.0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0
    • FLAGS
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0
    • 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0\0
    • win32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}\1.0
    • HELPDIR
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {54291324-7A3D-4F11-B707-3FB6A2C97BD9}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {C0585B2F-74D7-4734-88DE-6C150C5D4036}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {EF0588D6-1621-4A75-B8BE-F4BC34794136}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {23C70BCA-6E23-4A65-AD2E-1389062074F1}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {34C1FDF7-02C1-4F23-B393-F48B16E071D1}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {0D80F1C5-D17B-4177-AC68-955F3EF9F191}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
    • {295CACB4-51F5-46FD-914E-C72BAAE1B672}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
    • ProxyStubClsid
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
    • ProxyStubClsid32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • {B12E99ED-69BD-437C-86BE-C862B9E5444D}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • escortEng.DLL
  • In HKEY_CLASSES_ROOT
    • f
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\f
    • CLSID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\f
    • CurVer
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
    • {F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
    • ProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
    • VersionIndependentProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
    • Programmable
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
    • InprocServer32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
    • TypeLib
  • In HKEY_CLASSES_ROOT\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\instl
    • dfltLng
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Google\chrome\Extensions
    • fdloijijlkoblmigdofommgnheckmaki
  • In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
    • funmoods
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • {960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
    • esrv.EXE
  • In HKEY_CLASSES_ROOT
    • esrv.funmoodsESrvc.1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\esrv.funmoodsESrvc.1
    • CLSID
  • In HKEY_CLASSES_ROOT
    • esrv.funmoodsESrvc
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\esrv.funmoodsESrvc
    • CLSID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\esrv.funmoodsESrvc
    • CurVer
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
    • {75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
    • ProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
    • VersionIndependentProgID
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
    • Programmable
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
    • LocalServer32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
    • TypeLib
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
    • {960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
    • 1.0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0
    • FLAGS
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0
    • 0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\0
    • win32
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0
    • HELPDIR

手順 4

このレジストリ値を削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Funmoods\funmoods\Instl\Install
    • Start Page = "http://www.{BLOCKED}oft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs
    • Tabs = "http://start.{BLOCKED}ds.com/?f=2&a=down"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Funmoods\funmoods\Instl\Install
    • SearchAssistant = "http://ie.{BLOCKED}h.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Funmoods\funmoods\Instl\Install
    • Use Custom Search URL = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    • Use Custom Search URL = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}
    • URL = "http://start.{BLOCKED}ds.com/?a=down&s={searchTerms}&f=4"
  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}
    • DisplayName = "Search"
  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
    • DefaultScope = "{0D7562AE-8EF6-416d-A838-AB665251703A}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escorTlbr.DLL
    • AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\InprocServer32
    • ThreadingModel = "apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
    • AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
    • {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} = "Funmoods Toolbar"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}
    • Policy = "3"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}
    • AppName = "funmoodssrv.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}
    • AppPath = "%Program Files%\Funmoods\funmoods\1.5.11.16"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
    • NoExplorer = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escort.DLL
    • AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\InprocServer32
    • ThreadingModel = "apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}
    • AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\InprocServer32
    • ThreadingModel = "apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
    • AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortApp.DLL
    • AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\InprocServer32
    • ThreadingModel = "apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}
    • AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
    • hrdId = "68ad0fd00000000000000050569c013f"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
    • instlDay = "3c6d"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortEng.DLL
    • AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\InprocServer32
    • ThreadingModel = "apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
    • AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
    • vrsni = "1.5.11.16"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
    • afltId = "down"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
    • aflt = "down"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
    • smplGrp = "none"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
    • tlbrId = "base"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
    • vrsnTs = "1.5.11.161:10:56"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
    • tlbrSrchUrl = "http://start.{BLOCKED}ds.com/results.php?f=3&a=down&q="
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki
    • path = "%Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki
    • version = "1.4.5"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Funmoods\funmoods\Instl
    • InstallDir = "%Program Files%\Funmoods\funmoods\1.5.11.16"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods
    • DisplayName = "Funmoods on IE and Chrome"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods
    • UninstallString = "%Program Files%\Funmoods\funmoods\1.5.11.16\uninstall.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods
    • DisplayIcon = "%Program Files%\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods
    • NoModify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods
    • NoRepair = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\esrv.EXE
    • AppID = "{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\LocalServer32
    • ThreadingModel = "apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
    • AppID = "{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}"

手順 5

変更されたレジストリ値を修正します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    • From: Start Page = "http://start.{BLOCKED}ds.com/?f=1&a=down"
      To: Start Page = ""http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
    • From: SearchAssistant = "http://start.{BLOCKED}ds.com/results.php?f=4&a=down&q={searchTerms}"
      To: SearchAssistant = ""http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm""

手順 6

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %Application Data%\funmoods.exe
  • %Application Data%\facemoods.bmp
  • %Application Data%\dealply.bmp
  • %Application Data%\bloson.bmp
  • %Application Data%\lateral1.bmp
  • %Application Data%\lateral2.bmp
  • %Application Data%\lateral3.bmp
  • %User Temp%\nsa2.tmp\LangDLL.dll
  • %User Temp%\nsa2.tmp\nsRandom.dll
  • %User Temp%\nsa2.tmp\System.dll
  • %User Temp%\nsa2.tmp\modern-header.bmp
  • %User Temp%\nsa2.tmp\nsDialogs.dll
  • %User Temp%\nsa2.tmp\inetc.dll
  • %Application Data%\temp.u2d
  • %User Temp%\nsa2.tmp\md5dll.dll
  • %Application Data%\optimizador-condor-3.0.zip
  • %User Temp%\nsz4.tmp\UserInfo.dll
  • %User Temp%\nsz4.tmp\System.dll
  • %User Temp%\nsz4.tmp\nsisos.dll
  • %User Temp%\nsz4.tmp\mt.dll
  • %User Temp%\nsz4.tmp\Time.dll
  • %User Temp%\nsz4.tmp\Processes.dll
  • %User Temp%\FNMD\FM\1.5.11.16\FM4ffx.exe
  • %User Temp%\FNMD\FM\1.5.11.16\FM4ie.exe
  • %User Temp%\nsz4.tmp\InetLoad.dll
  • %User Temp%\FNMD\FM\1.5.11.16\nsis.js
  • %User Temp%\nsz4.tmp\NSISdl.dll
  • %User Temp%\nsm9.tmp
  • %User Temp%\nsn6.tmp\UserInfo.dll
  • %User Temp%\nsn6.tmp\System.dll
  • %User Temp%\nsn6.tmp\nsisos.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\bh\funmoods.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsApp.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsEng.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsTlbr.dll
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
  • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx
  • %Program Files%\Funmoods\funmoods\1.5.11.16\uninstall.exe
  • %User Temp%\nsd8.tmp\nsisos.dll
  • %User Temp%\nsd8.tmp\System.dll
  • %User Temp%\nsd8.tmp\mt.dll
  • %User Temp%\nsd8.tmp\Time.dll

手順 7

以下のフォルダを検索し削除します。

[ 詳細 ]
フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %System Root%\Documents and Settings\Wilbert
  • %System Root%\DOCUME~1
  • %System Root%\DOCUME~1\Wilbert
  • %User Profile%\LOCALS~1
  • %User Temp%\nsa2.tmp
  • %User Temp%\nsz4.tmp
  • %Program Files%\Mozilla Firefox
  • %Program Files%\Mozilla Firefox\extensions
  • %Program Files%\Mozilla Firefox\searchplugins
  • %User Temp%\FNMD
  • %User Temp%\FNMD\FM
  • %User Temp%\FNMD\FM\1.5.11.16
  • %User Temp%\nsn6.tmp
  • %Program Files%\Funmoods
  • %Program Files%\Funmoods\funmoods
  • %Program Files%\Funmoods\funmoods\1.5.11.16
  • %Program Files%\Funmoods\funmoods\1.5.11.16\bh
  • %User Temp%\nsd8.tmp
  • %User Temp%\mt_ffx
  • %User Temp%\mt_ffx\Funmoods
  • %User Temp%\mt_ffx\Funmoods\funmoods
  • %User Temp%\mt_ffx\Funmoods\funmoods\1.5.11.16

手順 8

最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「TROJ_PAM_000005043E.T3」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 9

以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

  • %User Temp%\nsy1.tmp
  • %User Temp%\nsa2.tmp
  • %User Temp%\nsj3.tmp
  • %User Temp%\nsz4.tmp
  • %User Temp%\nsm5.tmp
  • %User Temp%\nsn6.tmp
  • %User Temp%\nsy7.tmp
  • %User Temp%\nsd8.tmp


ご利用はいかがでしたか？　アンケートにご協力ください