Trend Micro Security

Trojan.Win32.STASER.E

2020年2月14日

 プラットフォーム:

Windows

 危険度:
 ダメージ度:
 感染力:
 感染確認数:


  • マルウェアタイプ: トロイの木馬型
  • 破壊活動の有無: なし
  • 暗号化:  
  • 感染報告の有無: はい

  概要


マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。


  詳細

ファイルサイズ 4,266,366 bytes
タイプ EXE
メモリ常駐 はい
発見日 2020年2月14日

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のプロセスを追加します。

  • "%User Temp%\is-7BM8C.tmp\{malware file name}.tmp" /SL5="$2015E,3885113,224256,{malware file path and name}"
  • "%System%\regsvr32.exe" /s "%Program Files%\Aurora Media Workshop\VideoEdit.ocx"
  • "%System%\regsvr32.exe" /s "%Program Files%\Aurora Media Workshop\mpeg2dmx.ax"
  • "%System%\regsvr32.exe" /s "%Program Files%\Aurora Media Workshop\mpgdec.ax"
  • "%System%\regsvr32.exe" /s "%Program Files%\Aurora Media Workshop\DirectEncode.dll"
  • "%System%\regsvr32.exe" /s "%Program Files%\Aurora Media Workshop\viscomwave.dll"
  • "%System%\regsvr32.exe" /s "%Program Files%\Aurora Media Workshop\NCTAudioPlayer2.dll"
  • "%System%\regsvr32.exe" /s "%Program Files%\Aurora Media Workshop\NCTAudioRecord2.dll"
  • "%System%\regsvr32.exe" /s "%Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll"
  • "%System%\regsvr32.exe" /s "%Program Files%\Aurora Media Workshop\WMVProfileEditor.ocx"
  • "%Program Files%\Aurora Media Workshop\AuroraMediaWorkshop.exe"

(註:%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\<ユーザー名>\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\<ユーザ名>\AppData\Local\Temp" です。. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files(x86)" です。)

マルウェアは、以下のフォルダを作成します。

  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X
  • %Program Files%\Aurora Media Workshop\skin
  • %Program Files%\Aurora Media Workshop\forceASPI17
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop
  • %User Temp%\is-V4OUL.tmp\_isetup
  • %Program Files%\Aurora Media Workshop
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT

(註:%Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files(x86)" です。. %All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\<ユーザー名>\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\<ユーザ名>\AppData\Local\Temp" です。)

他のシステム変更

マルウェアは、以下のファイルを削除します。

  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop\Aurora Media Workshop.pif
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop\Aurora Media Workshop.url

(註:%All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。)

マルウェアは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Owner = "\xf8\x0b\x00\x00\x18'\x03a\xd3\x84\xd5\x01"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
SessionHash = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Sequence = "1"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFiles0000 = "\x00\x00\x00\x00"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFilesHash = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
Inno Setup: Setup Version = "5.6.0 (a)"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
Inno Setup: App Path = "%Program Files%\Aurora Media Workshop"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
InstallLocation = "%Program Files%\Aurora Media Workshop"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
Inno Setup: Icon Group = "Aurora Media Workshop"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
Inno Setup: User = "{username}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
Inno Setup: Language = "default"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
DisplayName = "Aurora Media Workshop 3.4.47"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
UninstallString = "%Program Files%\Aurora Media Workshop\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
QuietUninstallString = "%Program Files%\Aurora Media Workshop\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
Publisher = "Aurora software, Inc."

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
URLInfoAbout = "http://www.{BLOCKED}ox.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
HelpLink = "http://www.{BLOCKED}ox.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
URLUpdateInfo = "http://www.{BLOCKED}ox.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
InstallDate = "20191017"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Aurora Media Workshop_is1
EstimatedSize = "9325"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{4D2B185F-005D-4151-AEFD-8F7E1161C636}
(Default) = "IVideoCompressors"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{4D2B185F-005D-4151-AEFD-8F7E1161C636}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{4D2B185F-005D-4151-AEFD-8F7E1161C636}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{4D2B185F-005D-4151-AEFD-8F7E1161C636}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C2E365A1-483E-4111-9702-F349B07623E0}
(Default) = "IAudioCompressors"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C2E365A1-483E-4111-9702-F349B07623E0}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C2E365A1-483E-4111-9702-F349B07623E0}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C2E365A1-483E-4111-9702-F349B07623E0}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}
(Default) = "IWMVProfiles"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{7A89DAA0-62F8-4252-880F-365E0A518A26}
(Default) = "ITransitions"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{7A89DAA0-62F8-4252-880F-365E0A518A26}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{7A89DAA0-62F8-4252-880F-365E0A518A26}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{7A89DAA0-62F8-4252-880F-365E0A518A26}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C3BF142B-8DDF-411A-904A-21865C569A9C}
(Default) = "IEffects"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C3BF142B-8DDF-411A-904A-21865C569A9C}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C3BF142B-8DDF-411A-904A-21865C569A9C}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{C3BF142B-8DDF-411A-904A-21865C569A9C}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{68F9B425-6EA2-4365-A956-83B5A396EBBF}
(Default) = "_DVideoEdit"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{68F9B425-6EA2-4365-A956-83B5A396EBBF}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{68F9B425-6EA2-4365-A956-83B5A396EBBF}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{68F9B425-6EA2-4365-A956-83B5A396EBBF}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{E050DEB5-639A-4730-80BC-A25AE602259D}
(Default) = "_DVideoEditEvents"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{E050DEB5-639A-4730-80BC-A25AE602259D}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{E050DEB5-639A-4730-80BC-A25AE602259D}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{E050DEB5-639A-4730-80BC-A25AE602259D}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{EA1F3829-2745-4181-955A-DBF78903B38F}
(Default) = "IWMVProfile"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{EA1F3829-2745-4181-955A-DBF78903B38F}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{EA1F3829-2745-4181-955A-DBF78903B38F}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{EA1F3829-2745-4181-955A-DBF78903B38F}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{A28929E9-5A90-4D2E-B34C-D303347EC55F}
(Default) = "IEnumWMVProfiles"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{A28929E9-5A90-4D2E-B34C-D303347EC55F}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{A28929E9-5A90-4D2E-B34C-D303347EC55F}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{A28929E9-5A90-4D2E-B34C-D303347EC55F}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}
(Default) = "IVideoCompressor"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{6839A0B0-F264-48E5-93C4-45635C1C928B}
(Default) = "IEnumVideoCompressors"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{6839A0B0-F264-48E5-93C4-45635C1C928B}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{6839A0B0-F264-48E5-93C4-45635C1C928B}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{6839A0B0-F264-48E5-93C4-45635C1C928B}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{132825D5-9CDB-416F-80CE-EF4038E6C60B}
(Default) = "IAudioCompressor"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{132825D5-9CDB-416F-80CE-EF4038E6C60B}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{132825D5-9CDB-416F-80CE-EF4038E6C60B}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{132825D5-9CDB-416F-80CE-EF4038E6C60B}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1E8A407C-2809-4243-87B8-17B3E2CC03FC}
(Default) = "IEnumAudioCompressors"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1E8A407C-2809-4243-87B8-17B3E2CC03FC}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1E8A407C-2809-4243-87B8-17B3E2CC03FC}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1E8A407C-2809-4243-87B8-17B3E2CC03FC}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}
(Default) = "ITransition"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}
(Default) = "IEnumTransitions"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{BA7B541A-5B8E-48C6-82DD-7841FE46320F}
(Default) = "IEffect"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{BA7B541A-5B8E-48C6-82DD-7841FE46320F}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{BA7B541A-5B8E-48C6-82DD-7841FE46320F}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{BA7B541A-5B8E-48C6-82DD-7841FE46320F}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B1C93753-37F9-42C7-BA46-507D93C809EF}
(Default) = "IEnumEffects"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B1C93753-37F9-42C7-BA46-507D93C809EF}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B1C93753-37F9-42C7-BA46-507D93C809EF}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B1C93753-37F9-42C7-BA46-507D93C809EF}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{2EEC36B3-5255-4F5A-9B0B-EC644326477B}
(Default) = "VideoEdit Property Page"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{2EEC36B3-5255-4F5A-9B0B-EC644326477B}\
InprocServer32
(Default) = "%Program Files%\AURORA~1\VIDEOE~1.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
VIDEOEDIT.VideoEditCtrl.1
(Default) = "VideoEdit Gold Control"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
VIDEOEDIT.VideoEditCtrl.1\CLSID
(Default) = "{57D9AF4C-23BA-47EC-A40B-2DA79641B285}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}
(Default) = "VideoEdit Gold Control"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\
ProgID
(Default) = "VIDEOEDIT.VideoEditCtrl.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\
InprocServer32
(Default) = "%Program Files%\AURORA~1\VIDEOE~1.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\
ToolboxBitmap32
(Default) = "%Program Files%\AURORA~1\VIDEOE~1.OCX, 1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\
MiscStatus
(Default) = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\
MiscStatus\1
(Default) = "131473"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\
Control
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\
TypeLib
(Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\
Version
(Default) = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\
InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{731B8592-4001-46D4-B1A5-33EC792B4501}
(Default) = "Elecard MPEG2 Demultiplexer"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{731B8592-4001-46D4-B1A5-33EC792B4501}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\mpeg2dmx.ax"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{731B8592-4001-46D4-B1A5-33EC792B4501}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{731B8682-4001-46D4-B1A5-33EC792B4501}
(Default) = "Elecard MPEG2 Demultiplexer Property Page"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{731B8682-4001-46D4-B1A5-33EC792B4501}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\mpeg2dmx.ax"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{731B8682-4001-46D4-B1A5-33EC792B4501}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{731B8592-4001-46D4-B1A5-33EC792B4501}
FriendlyName = "Elecard MPEG2 Demultiplexer"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{731B8592-4001-46D4-B1A5-33EC792B4501}
CLSID = "{731B8592-4001-46D4-B1A5-33EC792B4501}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{731B8592-4001-46D4-B1A5-33EC792B4501}
FilterData = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
(Default) = "Elecard MPEG2 Video Decoder"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\mpgdec.ax"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{F50B3F14-19C4-11CF-AA9A-02608C9BABA2}
(Default) = "Elecard MPEG2 Video Decoder Property Page"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{F50B3F14-19C4-11CF-AA9A-02608C9BABA2}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\mpgdec.ax"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{F50B3F14-19C4-11CF-AA9A-02608C9BABA2}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{F50B3F15-19C4-11CF-AA9A-02608C9BABA2}
(Default) = "Elecard MPEG2 Video Decoder Settings"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{F50B3F15-19C4-11CF-AA9A-02608C9BABA2}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\mpgdec.ax"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{F50B3F15-19C4-11CF-AA9A-02608C9BABA2}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
FriendlyName = "Elecard MPEG2 Video Decoder"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
CLSID = "{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
FilterData = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{3690DD35-542A-482A-A21C-63142EF9BC6F}
(Default) = "Essien MPEG Encoder Filter v4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{3690DD35-542A-482A-A21C-63142EF9BC6F}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\DirectEncode.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{3690DD35-542A-482A-A21C-63142EF9BC6F}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{EF6F5BB9-637E-4B27-B54D-51EA574AFCC5}
(Default) = "Essien MPEG Encoder Filter v4 Property Page"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{EF6F5BB9-637E-4B27-B54D-51EA574AFCC5}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\DirectEncode.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{EF6F5BB9-637E-4B27-B54D-51EA574AFCC5}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{3690DD35-542A-482A-A21C-63142EF9BC6F}
FriendlyName = "Essien MPEG Encoder Filter v4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{3690DD35-542A-482A-A21C-63142EF9BC6F}
CLSID = "{3690DD35-542A-482A-A21C-63142EF9BC6F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{3690DD35-542A-482A-A21C-63142EF9BC6F}
FilterData = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
(Default) = "WAV Dest"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\viscomwave.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
FriendlyName = "WAV Dest"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
CLSID = "{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\
Instance\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
FilterData = "\x02\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioPlayer2.AudioPlayer2.2
(Default) = "NCTAudioPlayer2 Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioPlayer2.AudioPlayer2.2\CLSID
(Default) = "{8532DECB-E102-48A8-BE72-DADC2B02C49F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioPlayer2.AudioPlayer2
(Default) = "NCTAudioPlayer2 Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioPlayer2.AudioPlayer2\CLSID
(Default) = "{8532DECB-E102-48A8-BE72-DADC2B02C49F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioPlayer2.AudioPlayer2\CurVer
(Default) = "NCTAudioPlayer2.AudioPlayer2.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}
(Default) = "NCTAudioPlayer2 Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\
ProgID
(Default) = "NCTAudioPlayer2.AudioPlayer2.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\
VersionIndependentProgID
(Default) = "NCTAudioPlayer2.AudioPlayer2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\NCTAudioPlayer2.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\
InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\
TypeLib
(Default) = "{2345C85B-969D-459C-90E9-D5E65ECC294E}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{DDED59B4-7070-4EA5-A688-90D80387E9CD}
(Default) = "IAudioPlayer2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{DDED59B4-7070-4EA5-A688-90D80387E9CD}\
ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{DDED59B4-7070-4EA5-A688-90D80387E9CD}\
TypeLib
(Default) = "{2345C85B-969D-459C-90E9-D5E65ECC294E}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{DDED59B4-7070-4EA5-A688-90D80387E9CD}\
TypeLib
Version = "2.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{46AC87BA-BEC7-4546-A226-A11F8438FE42}
(Default) = "_IAudioPlayer2Events"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{46AC87BA-BEC7-4546-A226-A11F8438FE42}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{46AC87BA-BEC7-4546-A226-A11F8438FE42}\
TypeLib
(Default) = "{2345C85B-969D-459C-90E9-D5E65ECC294E}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{46AC87BA-BEC7-4546-A226-A11F8438FE42}\
TypeLib
Version = "2.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioRecord2.AudioRecord2.2
(Default) = "NCTAudioRecord2 Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioRecord2.AudioRecord2.2\CLSID
(Default) = "{1C9920E5-7623-4AAF-936B-A14BCAB742EC}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioRecord2.AudioRecord2
(Default) = "NCTAudioRecord2 Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioRecord2.AudioRecord2\CLSID
(Default) = "{1C9920E5-7623-4AAF-936B-A14BCAB742EC}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioRecord2.AudioRecord2\CurVer
(Default) = "NCTAudioRecord2.AudioRecord2.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}
(Default) = "NCTAudioRecord2 Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\
ProgID
(Default) = "NCTAudioRecord2.AudioRecord2.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\
VersionIndependentProgID
(Default) = "NCTAudioRecord2.AudioRecord2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\NCTAudioRecord2.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\
InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\
TypeLib
(Default) = "{26AEB14D-8715-4281-AEAC-3343AEB2630F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{73F620FC-3000-44BC-A1C6-42DA6A2E2399}
(Default) = "IAudioRecord2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{73F620FC-3000-44BC-A1C6-42DA6A2E2399}\
ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{73F620FC-3000-44BC-A1C6-42DA6A2E2399}\
TypeLib
(Default) = "{26AEB14D-8715-4281-AEAC-3343AEB2630F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{73F620FC-3000-44BC-A1C6-42DA6A2E2399}\
TypeLib
Version = "2.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}
(Default) = "_IAudioRecord2Events"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}\
TypeLib
(Default) = "{26AEB14D-8715-4281-AEAC-3343AEB2630F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}\
TypeLib
Version = "2.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioVisualization2.AudioVisualization2.2
(Default) = "NCTAudioVisualization2 Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioVisualization2.AudioVisualization2.2\CLSID
(Default) = "{D24FF6DB-59CF-44D6-96B9-023A901EF476}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioVisualization2.AudioVisualization2
(Default) = "NCTAudioVisualization2 Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioVisualization2.AudioVisualization2\CLSID
(Default) = "{D24FF6DB-59CF-44D6-96B9-023A901EF476}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NCTAudioVisualization2.AudioVisualization2\CurVer
(Default) = "NCTAudioVisualization2.AudioVisualization2.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}
(Default) = "NCTAudioVisualization2 Class"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\
ProgID
(Default) = "NCTAudioVisualization2.AudioVisualization2.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\
VersionIndependentProgID
(Default) = "NCTAudioVisualization2.AudioVisualization2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\
InprocServer32
(Default) = "%Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\
InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\
ToolboxBitmap32
(Default) = "%Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll, 101"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\
MiscStatus
(Default) = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\
MiscStatus\1
(Default) = "131473"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\
TypeLib
(Default) = "{32505FA1-6E30-4E62-BBF6-D0AF7AF4733F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\
Version
(Default) = "2.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{5B227078-049D-4679-BA05-7E58847AA314}
(Default) = "IAudioVisualization2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{5B227078-049D-4679-BA05-7E58847AA314}\
ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{5B227078-049D-4679-BA05-7E58847AA314}\
TypeLib
(Default) = "{32505FA1-6E30-4E62-BBF6-D0AF7AF4733F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{5B227078-049D-4679-BA05-7E58847AA314}\
TypeLib
Version = "2.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}
(Default) = "_IAudioVisualization2Events"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}\
TypeLib
(Default) = "{32505FA1-6E30-4E62-BBF6-D0AF7AF4733F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}\
TypeLib
Version = "2.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}
(Default) = "IVideoCodecs"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1B2D3B6E-1623-47BC-813C-4C953395A735}
(Default) = "IAudioCodecs"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1B2D3B6E-1623-47BC-813C-4C953395A735}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1B2D3B6E-1623-47BC-813C-4C953395A735}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{1B2D3B6E-1623-47BC-813C-4C953395A735}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}
(Default) = "IAudioFormats"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}
(Default) = "ILanguages"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}
(Default) = "_DWMVProfileEditor"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{899BDC5C-4F40-400A-A524-A7DC2C61841B}
(Default) = "_DWMVProfileEditorEvents"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{899BDC5C-4F40-400A-A524-A7DC2C61841B}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{899BDC5C-4F40-400A-A524-A7DC2C61841B}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{899BDC5C-4F40-400A-A524-A7DC2C61841B}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{80F58506-33D5-406D-BDBA-09F7B9B1740A}
(Default) = "IVideoCodec"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{80F58506-33D5-406D-BDBA-09F7B9B1740A}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{80F58506-33D5-406D-BDBA-09F7B9B1740A}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{80F58506-33D5-406D-BDBA-09F7B9B1740A}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{4174C2F6-BF59-426C-AD90-BFC5B9398591}
(Default) = "IEnumVideoCodecs"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{4174C2F6-BF59-426C-AD90-BFC5B9398591}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{4174C2F6-BF59-426C-AD90-BFC5B9398591}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{4174C2F6-BF59-426C-AD90-BFC5B9398591}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}
(Default) = "IAudioCodec"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}
(Default) = "IEnumAudioCodecs"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{F0E12FC4-334A-400C-937B-43FD4880BE4F}
(Default) = "IAudioFormat"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{F0E12FC4-334A-400C-937B-43FD4880BE4F}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{F0E12FC4-334A-400C-937B-43FD4880BE4F}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{F0E12FC4-334A-400C-937B-43FD4880BE4F}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}
(Default) = "IEnumAudioFormats"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{95603D96-D1DB-42D4-8A06-353C6B4B8A63}
(Default) = "ILang"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{95603D96-D1DB-42D4-8A06-353C6B4B8A63}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{95603D96-D1DB-42D4-8A06-353C6B4B8A63}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{95603D96-D1DB-42D4-8A06-353C6B4B8A63}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{88CA0382-1A63-4764-A29C-759AEFF56156}
(Default) = "ILanguage"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{88CA0382-1A63-4764-A29C-759AEFF56156}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{88CA0382-1A63-4764-A29C-759AEFF56156}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{88CA0382-1A63-4764-A29C-759AEFF56156}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B37CA430-C178-4C52-9F46-38A3747E61E0}
(Default) = "IEnumLanguages"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B37CA430-C178-4C52-9F46-38A3747E61E0}\
ProxyStubClsid32
(Default) = "{00020420-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B37CA430-C178-4C52-9F46-38A3747E61E0}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{B37CA430-C178-4C52-9F46-38A3747E61E0}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{1767B1D4-EF8A-4438-806E-3E6DEBA9368A}
(Default) = "WMVProfileEditor Property Page"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{1767B1D4-EF8A-4438-806E-3E6DEBA9368A}\
InprocServer32
(Default) = "%Program Files%\AURORA~1\WMVPRO~1.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMVPROFILEEDITOR.WMVProfileEditorCtrl.1
(Default) = "WMVProfileEditor Control"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMVPROFILEEDITOR.WMVProfileEditorCtrl.1\CLSID
(Default) = "{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}
(Default) = "WMVProfileEditor Control"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\
ProgID
(Default) = "WMVPROFILEEDITOR.WMVProfileEditorCtrl.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\
InprocServer32
(Default) = "%Program Files%\AURORA~1\WMVPRO~1.OCX"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\
ToolboxBitmap32
(Default) = "%Program Files%\AURORA~1\WMVPRO~1.OCX, 1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\
MiscStatus
(Default) = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\
MiscStatus\1
(Default) = "131473"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\
Control
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\
TypeLib
(Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\
Version
(Default) = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\
InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
WIFIService
idconst_34162 = "1"

マルウェアは、以下のレジストリキーを削除します。

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\RegFilesHash

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\RegFiles0000

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\Sequence

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\SessionHash

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\Owner

作成活動

マルウェアは、以下のファイルを作成します。

  • %System%\is-FCPU4.tmp
  • %Program Files%\Aurora Media Workshop\is-DTEDS.tmp
  • %Program Files%\Aurora Media Workshop\is-MDE5G.tmp
  • %Program Files%\Aurora Media Workshop\is-UNDPG.tmp
  • %Program Files%\Aurora Media Workshop\is-0EF6D.tmp
  • %Program Files%\Aurora Media Workshop\is-B9D5O.tmp
  • %Program Files%\Aurora Media Workshop\buynow.url
  • %Program Files%\Aurora Media Workshop\homepage.url
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\WINASPI.DLL
  • %Program Files%\Aurora Media Workshop\vcdimager.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\ASPIENUM.VXD
  • %Program Files%\Aurora Media Workshop\is-I5Q66.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\frcASPI.txt
  • %Program Files%\Aurora Media Workshop\forceASPI17\InstallASPI.bat
  • %Program Files%\Aurora Media Workshop\libsnd.dll
  • %Program Files%\Aurora Media Workshop\TIPS.TXT
  • %Program Files%\Aurora Media Workshop\skin\winaqua.smf
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\WOWPOST.EXE
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\WNASPI32.DLL
  • %Program Files%\Aurora Media Workshop\msvcr70.dll
  • %Program Files%\Aurora Media Workshop\NCTAudioRecord2.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\WNASPI32.DLL
  • %Program Files%\Aurora Media Workshop\is-5OJK2.tmp
  • %Program Files%\Aurora Media Workshop\AuroraMediaWorkshop.exe
  • %Program Files%\Aurora Media Workshop\setup.ini
  • %Program Files%\Aurora Media Workshop\is-IO1SG.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-FOGJ3.tmp
  • %Program Files%\Aurora Media Workshop\is-O53JL.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-VKC9J.tmp
  • %Program Files%\Aurora Media Workshop\is-0CK7O.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-BI7VF.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\WIN9X.REG
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop\Aurora Media Workshop.lnk
  • %Program Files%\Aurora Media Workshop\is-IVFNU.tmp
  • %Program Files%\Aurora Media Workshop\is-8K4AD.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-68DCF.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WINNT.REG
  • %Program Files%\Aurora Media Workshop\is-6BR8T.tmp
  • %Program Files%\Aurora Media Workshop\unins000.exe
  • %Program Files%\Aurora Media Workshop\vorbis.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-7RTD9.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-UPSE3.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\is-GAIJ1.tmp
  • %Program Files%\Aurora Media Workshop\is-DLDNF.tmp
  • %Program Files%\Aurora Media Workshop\is-12IRR.tmp
  • %Program Files%\Aurora Media Workshop\license.TXT
  • %Program Files%\Aurora Media Workshop\is-K15H3.tmp
  • %Program Files%\Aurora Media Workshop\is-S64LV.tmp
  • %Program Files%\Aurora Media Workshop\skin\is-NVQ4J.tmp
  • %Program Files%\Aurora Media Workshop\is-NJKIV.tmp
  • %Program Files%\Aurora Media Workshop\viscomimage.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-4FVV3.tmp
  • %Program Files%\Aurora Media Workshop\is-64AHV.tmp
  • %Program Files%\Aurora Media Workshop\is-UR68V.tmp
  • %Program Files%\Aurora Media Workshop\is-C9DF1.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-SGOLA.tmp
  • %User Temp%\fix150120.dat
  • %Program Files%\Aurora Media Workshop\is-F1MVR.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-UCC5P.tmp
  • %Program Files%\Aurora Media Workshop\is-VONCQ.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\ASPI32.SYS
  • %Program Files%\Aurora Media Workshop\is-M6TIC.tmp
  • %Program Files%\Aurora Media Workshop\mp3lib.dll
  • %Program Files%\Aurora Media Workshop\is-MBU4D.tmp
  • %Program Files%\Aurora Media Workshop\readme.TXT
  • %Program Files%\Aurora Media Workshop\mpeg2dmx.ax
  • %Program Files%\Aurora Media Workshop\is-I667T.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-N0HAN.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-FNFJ5.tmp
  • %Program Files%\Aurora Media Workshop\cdrip.dll
  • %Program Files%\Aurora Media Workshop\unins000.dat
  • %Program Files%\Aurora Media Workshop\skinmagic.dll
  • %Program Files%\Aurora Media Workshop\NCTAudioPlayer2.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WOWPOST.EXE
  • %Program Files%\Aurora Media Workshop\Help.CHM
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WINASPI.DLL
  • %Program Files%\Aurora Media Workshop\is-GN80O.tmp
  • %Program Files%\Google\Update\GoogleUpdate.exe
  • %Program Files%\Aurora Media Workshop\is-AHQ81.tmp
  • %Program Files%\Aurora Media Workshop\Support.ini
  • %Program Files%\Aurora Media Workshop\viscomwave.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-NQQKE.tmp
  • %Program Files%\Aurora Media Workshop\is-H7HJM.tmp
  • %Program Files%\Aurora Media Workshop\VideoEdit.ocx
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\APIX.VXD
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\WINASPI.DLL
  • %Program Files%\Aurora Media Workshop\WMVProfileEditor.ocx
  • %Program Files%\Aurora Media Workshop\msvcr71.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-6H70E.tmp
  • %System%\smd.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WNASPI32.DLL
  • %Program Files%\Aurora Media Workshop\is-6SLN6.tmp
  • %Program Files%\Aurora Media Workshop\wmaudsdk.dll
  • %Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll
  • %Program Files%\Aurora Media Workshop\is-71UQA.tmp
  • %Program Files%\Aurora Media Workshop\msvcrt.dll
  • %Program Files%\Aurora Media Workshop\lame_enc.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-HSFNB.tmp
  • %Program Files%\Aurora Media Workshop\Foxburner.dll
  • %Program Files%\Aurora Media Workshop\is-3JHS3.tmp
  • %Program Files%\Aurora Media Workshop\DirectEncode.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-H29T1.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\ASPI32.SYS
  • %Program Files%\Aurora Media Workshop\mpgdec.ax

(註:%System%フォルダは、システムフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows\System32" です。.. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files(x86)" です。. %All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\<ユーザー名>\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\<ユーザ名>\AppData\Local\Temp" です。)

このウイルス情報は、自動解析システムにより作成されました。


  対応方法

対応検索エンジン: 9.850

手順 1

Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

「Trojan.Win32.STASER.E」で検出したファイル名を確認し、そのファイルを終了します。

[ 詳細 ]

  • すべての実行中プロセスが、Windows のタスクマネージャに表示されない場合があります。この場合、"Process Explorer" などのツールを使用しマルウェアのファイルを終了してください。"Process Explorer" については、こちらをご参照下さい。
  • 検出ファイルが、Windows のタスクマネージャまたは "Process Explorer" に表示されるものの、削除できない場合があります。この場合、コンピュータをセーフモードで再起動してください。
    セーフモードについては、こちらをご参照下さい。
  • 検出ファイルがタスクマネージャ上で表示されない場合、次の手順にお進みください。

手順 3

このレジストリ値を削除します。

[ 詳細 ]

警告:レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • Owner = "\xf8\x0b\x00\x00\x18'\x03a\xd3\x84\xd5\x01"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • SessionHash = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • Sequence = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • RegFiles0000 = "\x00\x00\x00\x00"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • RegFilesHash = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • Inno Setup: Setup Version = "5.6.0 (a)"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • Inno Setup: App Path = "%Program Files%\Aurora Media Workshop"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • InstallLocation = "%Program Files%\Aurora Media Workshop"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • Inno Setup: Icon Group = "Aurora Media Workshop"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • Inno Setup: User = "{username}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • Inno Setup: Language = "default"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • DisplayName = "Aurora Media Workshop 3.4.47"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • UninstallString = "%Program Files%\Aurora Media Workshop\unins000.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • QuietUninstallString = "%Program Files%\Aurora Media Workshop\unins000.exe /SILENT"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • Publisher = "Aurora software, Inc."
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • URLInfoAbout = "http://www.{BLOCKED}ox.com"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • HelpLink = "http://www.{BLOCKED}ox.com"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • URLUpdateInfo = "http://www.{BLOCKED}ox.com"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • NoModify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • NoRepair = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • InstallDate = "20191017"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aurora Media Workshop_is1
    • EstimatedSize = "9325"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D2B185F-005D-4151-AEFD-8F7E1161C636}
    • (Default) = "IVideoCompressors"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D2B185F-005D-4151-AEFD-8F7E1161C636}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D2B185F-005D-4151-AEFD-8F7E1161C636}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D2B185F-005D-4151-AEFD-8F7E1161C636}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2E365A1-483E-4111-9702-F349B07623E0}
    • (Default) = "IAudioCompressors"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2E365A1-483E-4111-9702-F349B07623E0}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2E365A1-483E-4111-9702-F349B07623E0}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2E365A1-483E-4111-9702-F349B07623E0}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}
    • (Default) = "IWMVProfiles"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7A89DAA0-62F8-4252-880F-365E0A518A26}
    • (Default) = "ITransitions"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7A89DAA0-62F8-4252-880F-365E0A518A26}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7A89DAA0-62F8-4252-880F-365E0A518A26}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7A89DAA0-62F8-4252-880F-365E0A518A26}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C3BF142B-8DDF-411A-904A-21865C569A9C}
    • (Default) = "IEffects"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C3BF142B-8DDF-411A-904A-21865C569A9C}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C3BF142B-8DDF-411A-904A-21865C569A9C}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C3BF142B-8DDF-411A-904A-21865C569A9C}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68F9B425-6EA2-4365-A956-83B5A396EBBF}
    • (Default) = "_DVideoEdit"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68F9B425-6EA2-4365-A956-83B5A396EBBF}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68F9B425-6EA2-4365-A956-83B5A396EBBF}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68F9B425-6EA2-4365-A956-83B5A396EBBF}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E050DEB5-639A-4730-80BC-A25AE602259D}
    • (Default) = "_DVideoEditEvents"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E050DEB5-639A-4730-80BC-A25AE602259D}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E050DEB5-639A-4730-80BC-A25AE602259D}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E050DEB5-639A-4730-80BC-A25AE602259D}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EA1F3829-2745-4181-955A-DBF78903B38F}
    • (Default) = "IWMVProfile"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EA1F3829-2745-4181-955A-DBF78903B38F}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EA1F3829-2745-4181-955A-DBF78903B38F}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EA1F3829-2745-4181-955A-DBF78903B38F}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A28929E9-5A90-4D2E-B34C-D303347EC55F}
    • (Default) = "IEnumWMVProfiles"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A28929E9-5A90-4D2E-B34C-D303347EC55F}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A28929E9-5A90-4D2E-B34C-D303347EC55F}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A28929E9-5A90-4D2E-B34C-D303347EC55F}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}
    • (Default) = "IVideoCompressor"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6839A0B0-F264-48E5-93C4-45635C1C928B}
    • (Default) = "IEnumVideoCompressors"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6839A0B0-F264-48E5-93C4-45635C1C928B}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6839A0B0-F264-48E5-93C4-45635C1C928B}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6839A0B0-F264-48E5-93C4-45635C1C928B}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{132825D5-9CDB-416F-80CE-EF4038E6C60B}
    • (Default) = "IAudioCompressor"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{132825D5-9CDB-416F-80CE-EF4038E6C60B}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{132825D5-9CDB-416F-80CE-EF4038E6C60B}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{132825D5-9CDB-416F-80CE-EF4038E6C60B}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E8A407C-2809-4243-87B8-17B3E2CC03FC}
    • (Default) = "IEnumAudioCompressors"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E8A407C-2809-4243-87B8-17B3E2CC03FC}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E8A407C-2809-4243-87B8-17B3E2CC03FC}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E8A407C-2809-4243-87B8-17B3E2CC03FC}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}
    • (Default) = "ITransition"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}
    • (Default) = "IEnumTransitions"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA7B541A-5B8E-48C6-82DD-7841FE46320F}
    • (Default) = "IEffect"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA7B541A-5B8E-48C6-82DD-7841FE46320F}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA7B541A-5B8E-48C6-82DD-7841FE46320F}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA7B541A-5B8E-48C6-82DD-7841FE46320F}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1C93753-37F9-42C7-BA46-507D93C809EF}
    • (Default) = "IEnumEffects"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1C93753-37F9-42C7-BA46-507D93C809EF}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1C93753-37F9-42C7-BA46-507D93C809EF}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1C93753-37F9-42C7-BA46-507D93C809EF}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2EEC36B3-5255-4F5A-9B0B-EC644326477B}
    • (Default) = "VideoEdit Property Page"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2EEC36B3-5255-4F5A-9B0B-EC644326477B}\InprocServer32
    • (Default) = "%Program Files%\AURORA~1\VIDEOE~1.OCX"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VIDEOEDIT.VideoEditCtrl.1
    • (Default) = "VideoEdit Gold Control"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VIDEOEDIT.VideoEditCtrl.1\CLSID
    • (Default) = "{57D9AF4C-23BA-47EC-A40B-2DA79641B285}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}
    • (Default) = "VideoEdit Gold Control"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\ProgID
    • (Default) = "VIDEOEDIT.VideoEditCtrl.1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\InprocServer32
    • (Default) = "%Program Files%\AURORA~1\VIDEOE~1.OCX"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\ToolboxBitmap32
    • (Default) = "%Program Files%\AURORA~1\VIDEOE~1.OCX, 1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\MiscStatus
    • (Default) = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\MiscStatus\1
    • (Default) = "131473"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\Control
    • (Default) = ""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\TypeLib
    • (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\Version
    • (Default) = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57D9AF4C-23BA-47EC-A40B-2DA79641B285}\InprocServer32
    • ThreadingModel = "Apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{731B8592-4001-46D4-B1A5-33EC792B4501}
    • (Default) = "Elecard MPEG2 Demultiplexer"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{731B8592-4001-46D4-B1A5-33EC792B4501}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\mpeg2dmx.ax"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{731B8592-4001-46D4-B1A5-33EC792B4501}\InprocServer32
    • ThreadingModel = "Both"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{731B8682-4001-46D4-B1A5-33EC792B4501}
    • (Default) = "Elecard MPEG2 Demultiplexer Property Page"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{731B8682-4001-46D4-B1A5-33EC792B4501}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\mpeg2dmx.ax"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{731B8682-4001-46D4-B1A5-33EC792B4501}\InprocServer32
    • ThreadingModel = "Both"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{731B8592-4001-46D4-B1A5-33EC792B4501}
    • FriendlyName = "Elecard MPEG2 Demultiplexer"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{731B8592-4001-46D4-B1A5-33EC792B4501}
    • CLSID = "{731B8592-4001-46D4-B1A5-33EC792B4501}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{731B8592-4001-46D4-B1A5-33EC792B4501}
    • FilterData = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
    • (Default) = "Elecard MPEG2 Video Decoder"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\mpgdec.ax"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}\InprocServer32
    • ThreadingModel = "Both"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F50B3F14-19C4-11CF-AA9A-02608C9BABA2}
    • (Default) = "Elecard MPEG2 Video Decoder Property Page"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F50B3F14-19C4-11CF-AA9A-02608C9BABA2}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\mpgdec.ax"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F50B3F14-19C4-11CF-AA9A-02608C9BABA2}\InprocServer32
    • ThreadingModel = "Both"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F50B3F15-19C4-11CF-AA9A-02608C9BABA2}
    • (Default) = "Elecard MPEG2 Video Decoder Settings"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F50B3F15-19C4-11CF-AA9A-02608C9BABA2}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\mpgdec.ax"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F50B3F15-19C4-11CF-AA9A-02608C9BABA2}\InprocServer32
    • ThreadingModel = "Both"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
    • FriendlyName = "Elecard MPEG2 Video Decoder"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
    • CLSID = "{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
    • FilterData = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3690DD35-542A-482A-A21C-63142EF9BC6F}
    • (Default) = "Essien MPEG Encoder Filter v4"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3690DD35-542A-482A-A21C-63142EF9BC6F}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\DirectEncode.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3690DD35-542A-482A-A21C-63142EF9BC6F}\InprocServer32
    • ThreadingModel = "Both"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF6F5BB9-637E-4B27-B54D-51EA574AFCC5}
    • (Default) = "Essien MPEG Encoder Filter v4 Property Page"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF6F5BB9-637E-4B27-B54D-51EA574AFCC5}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\DirectEncode.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF6F5BB9-637E-4B27-B54D-51EA574AFCC5}\InprocServer32
    • ThreadingModel = "Both"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3690DD35-542A-482A-A21C-63142EF9BC6F}
    • FriendlyName = "Essien MPEG Encoder Filter v4"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3690DD35-542A-482A-A21C-63142EF9BC6F}
    • CLSID = "{3690DD35-542A-482A-A21C-63142EF9BC6F}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3690DD35-542A-482A-A21C-63142EF9BC6F}
    • FilterData = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
    • (Default) = "WAV Dest"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\viscomwave.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}\InprocServer32
    • ThreadingModel = "Both"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
    • FriendlyName = "WAV Dest"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
    • CLSID = "{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
    • FilterData = "\x02\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioPlayer2.AudioPlayer2.2
    • (Default) = "NCTAudioPlayer2 Class"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioPlayer2.AudioPlayer2.2\CLSID
    • (Default) = "{8532DECB-E102-48A8-BE72-DADC2B02C49F}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioPlayer2.AudioPlayer2
    • (Default) = "NCTAudioPlayer2 Class"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioPlayer2.AudioPlayer2\CLSID
    • (Default) = "{8532DECB-E102-48A8-BE72-DADC2B02C49F}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioPlayer2.AudioPlayer2\CurVer
    • (Default) = "NCTAudioPlayer2.AudioPlayer2.2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}
    • (Default) = "NCTAudioPlayer2 Class"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\ProgID
    • (Default) = "NCTAudioPlayer2.AudioPlayer2.2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\VersionIndependentProgID
    • (Default) = "NCTAudioPlayer2.AudioPlayer2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\NCTAudioPlayer2.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\InprocServer32
    • ThreadingModel = "Apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8532DECB-E102-48A8-BE72-DADC2B02C49F}\TypeLib
    • (Default) = "{2345C85B-969D-459C-90E9-D5E65ECC294E}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDED59B4-7070-4EA5-A688-90D80387E9CD}
    • (Default) = "IAudioPlayer2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDED59B4-7070-4EA5-A688-90D80387E9CD}\ProxyStubClsid32
    • (Default) = "{00020424-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDED59B4-7070-4EA5-A688-90D80387E9CD}\TypeLib
    • (Default) = "{2345C85B-969D-459C-90E9-D5E65ECC294E}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDED59B4-7070-4EA5-A688-90D80387E9CD}\TypeLib
    • Version = "2.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{46AC87BA-BEC7-4546-A226-A11F8438FE42}
    • (Default) = "_IAudioPlayer2Events"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{46AC87BA-BEC7-4546-A226-A11F8438FE42}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{46AC87BA-BEC7-4546-A226-A11F8438FE42}\TypeLib
    • (Default) = "{2345C85B-969D-459C-90E9-D5E65ECC294E}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{46AC87BA-BEC7-4546-A226-A11F8438FE42}\TypeLib
    • Version = "2.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioRecord2.AudioRecord2.2
    • (Default) = "NCTAudioRecord2 Class"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioRecord2.AudioRecord2.2\CLSID
    • (Default) = "{1C9920E5-7623-4AAF-936B-A14BCAB742EC}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioRecord2.AudioRecord2
    • (Default) = "NCTAudioRecord2 Class"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioRecord2.AudioRecord2\CLSID
    • (Default) = "{1C9920E5-7623-4AAF-936B-A14BCAB742EC}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioRecord2.AudioRecord2\CurVer
    • (Default) = "NCTAudioRecord2.AudioRecord2.2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}
    • (Default) = "NCTAudioRecord2 Class"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\ProgID
    • (Default) = "NCTAudioRecord2.AudioRecord2.2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\VersionIndependentProgID
    • (Default) = "NCTAudioRecord2.AudioRecord2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\NCTAudioRecord2.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\InprocServer32
    • ThreadingModel = "Apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\TypeLib
    • (Default) = "{26AEB14D-8715-4281-AEAC-3343AEB2630F}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{73F620FC-3000-44BC-A1C6-42DA6A2E2399}
    • (Default) = "IAudioRecord2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{73F620FC-3000-44BC-A1C6-42DA6A2E2399}\ProxyStubClsid32
    • (Default) = "{00020424-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{73F620FC-3000-44BC-A1C6-42DA6A2E2399}\TypeLib
    • (Default) = "{26AEB14D-8715-4281-AEAC-3343AEB2630F}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{73F620FC-3000-44BC-A1C6-42DA6A2E2399}\TypeLib
    • Version = "2.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}
    • (Default) = "_IAudioRecord2Events"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}\TypeLib
    • (Default) = "{26AEB14D-8715-4281-AEAC-3343AEB2630F}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}\TypeLib
    • Version = "2.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioVisualization2.AudioVisualization2.2
    • (Default) = "NCTAudioVisualization2 Class"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioVisualization2.AudioVisualization2.2\CLSID
    • (Default) = "{D24FF6DB-59CF-44D6-96B9-023A901EF476}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioVisualization2.AudioVisualization2
    • (Default) = "NCTAudioVisualization2 Class"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioVisualization2.AudioVisualization2\CLSID
    • (Default) = "{D24FF6DB-59CF-44D6-96B9-023A901EF476}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCTAudioVisualization2.AudioVisualization2\CurVer
    • (Default) = "NCTAudioVisualization2.AudioVisualization2.2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}
    • (Default) = "NCTAudioVisualization2 Class"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\ProgID
    • (Default) = "NCTAudioVisualization2.AudioVisualization2.2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\VersionIndependentProgID
    • (Default) = "NCTAudioVisualization2.AudioVisualization2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\InprocServer32
    • (Default) = "%Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\InprocServer32
    • ThreadingModel = "Apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\ToolboxBitmap32
    • (Default) = "%Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll, 101"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\MiscStatus
    • (Default) = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\MiscStatus\1
    • (Default) = "131473"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\TypeLib
    • (Default) = "{32505FA1-6E30-4E62-BBF6-D0AF7AF4733F}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\Version
    • (Default) = "2.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B227078-049D-4679-BA05-7E58847AA314}
    • (Default) = "IAudioVisualization2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B227078-049D-4679-BA05-7E58847AA314}\ProxyStubClsid32
    • (Default) = "{00020424-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B227078-049D-4679-BA05-7E58847AA314}\TypeLib
    • (Default) = "{32505FA1-6E30-4E62-BBF6-D0AF7AF4733F}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B227078-049D-4679-BA05-7E58847AA314}\TypeLib
    • Version = "2.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}
    • (Default) = "_IAudioVisualization2Events"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}\TypeLib
    • (Default) = "{32505FA1-6E30-4E62-BBF6-D0AF7AF4733F}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}\TypeLib
    • Version = "2.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}
    • (Default) = "IVideoCodecs"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B2D3B6E-1623-47BC-813C-4C953395A735}
    • (Default) = "IAudioCodecs"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B2D3B6E-1623-47BC-813C-4C953395A735}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B2D3B6E-1623-47BC-813C-4C953395A735}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B2D3B6E-1623-47BC-813C-4C953395A735}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}
    • (Default) = "IAudioFormats"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}
    • (Default) = "ILanguages"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}
    • (Default) = "_DWMVProfileEditor"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{899BDC5C-4F40-400A-A524-A7DC2C61841B}
    • (Default) = "_DWMVProfileEditorEvents"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{899BDC5C-4F40-400A-A524-A7DC2C61841B}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{899BDC5C-4F40-400A-A524-A7DC2C61841B}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{899BDC5C-4F40-400A-A524-A7DC2C61841B}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80F58506-33D5-406D-BDBA-09F7B9B1740A}
    • (Default) = "IVideoCodec"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80F58506-33D5-406D-BDBA-09F7B9B1740A}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80F58506-33D5-406D-BDBA-09F7B9B1740A}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80F58506-33D5-406D-BDBA-09F7B9B1740A}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4174C2F6-BF59-426C-AD90-BFC5B9398591}
    • (Default) = "IEnumVideoCodecs"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4174C2F6-BF59-426C-AD90-BFC5B9398591}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4174C2F6-BF59-426C-AD90-BFC5B9398591}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4174C2F6-BF59-426C-AD90-BFC5B9398591}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}
    • (Default) = "IAudioCodec"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}
    • (Default) = "IEnumAudioCodecs"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F0E12FC4-334A-400C-937B-43FD4880BE4F}
    • (Default) = "IAudioFormat"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F0E12FC4-334A-400C-937B-43FD4880BE4F}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F0E12FC4-334A-400C-937B-43FD4880BE4F}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F0E12FC4-334A-400C-937B-43FD4880BE4F}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}
    • (Default) = "IEnumAudioFormats"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{95603D96-D1DB-42D4-8A06-353C6B4B8A63}
    • (Default) = "ILang"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{95603D96-D1DB-42D4-8A06-353C6B4B8A63}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{95603D96-D1DB-42D4-8A06-353C6B4B8A63}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{95603D96-D1DB-42D4-8A06-353C6B4B8A63}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{88CA0382-1A63-4764-A29C-759AEFF56156}
    • (Default) = "ILanguage"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{88CA0382-1A63-4764-A29C-759AEFF56156}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{88CA0382-1A63-4764-A29C-759AEFF56156}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{88CA0382-1A63-4764-A29C-759AEFF56156}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B37CA430-C178-4C52-9F46-38A3747E61E0}
    • (Default) = "IEnumLanguages"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B37CA430-C178-4C52-9F46-38A3747E61E0}\ProxyStubClsid32
    • (Default) = "{00020420-0000-0000-C000-000000000046}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B37CA430-C178-4C52-9F46-38A3747E61E0}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B37CA430-C178-4C52-9F46-38A3747E61E0}\TypeLib
    • Version = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1767B1D4-EF8A-4438-806E-3E6DEBA9368A}
    • (Default) = "WMVProfileEditor Property Page"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1767B1D4-EF8A-4438-806E-3E6DEBA9368A}\InprocServer32
    • (Default) = "%Program Files%\AURORA~1\WMVPRO~1.OCX"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMVPROFILEEDITOR.WMVProfileEditorCtrl.1
    • (Default) = "WMVProfileEditor Control"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMVPROFILEEDITOR.WMVProfileEditorCtrl.1\CLSID
    • (Default) = "{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}
    • (Default) = "WMVProfileEditor Control"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\ProgID
    • (Default) = "WMVPROFILEEDITOR.WMVProfileEditorCtrl.1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\InprocServer32
    • (Default) = "%Program Files%\AURORA~1\WMVPRO~1.OCX"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\ToolboxBitmap32
    • (Default) = "%Program Files%\AURORA~1\WMVPRO~1.OCX, 1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\MiscStatus
    • (Default) = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\MiscStatus\1
    • (Default) = "131473"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\Control
    • (Default) = ""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\TypeLib
    • (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\Version
    • (Default) = "1.0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}\InprocServer32
    • ThreadingModel = "Apartment"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\WIFIService
    • idconst_34162 = "1"

手順 4

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %System%\is-FCPU4.tmp
  • %Program Files%\Aurora Media Workshop\is-DTEDS.tmp
  • %Program Files%\Aurora Media Workshop\is-MDE5G.tmp
  • %Program Files%\Aurora Media Workshop\is-UNDPG.tmp
  • %Program Files%\Aurora Media Workshop\is-0EF6D.tmp
  • %Program Files%\Aurora Media Workshop\is-B9D5O.tmp
  • %Program Files%\Aurora Media Workshop\buynow.url
  • %Program Files%\Aurora Media Workshop\homepage.url
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\WINASPI.DLL
  • %Program Files%\Aurora Media Workshop\vcdimager.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\ASPIENUM.VXD
  • %Program Files%\Aurora Media Workshop\is-I5Q66.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\frcASPI.txt
  • %Program Files%\Aurora Media Workshop\forceASPI17\InstallASPI.bat
  • %Program Files%\Aurora Media Workshop\libsnd.dll
  • %Program Files%\Aurora Media Workshop\TIPS.TXT
  • %Program Files%\Aurora Media Workshop\skin\winaqua.smf
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\WOWPOST.EXE
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\WNASPI32.DLL
  • %Program Files%\Aurora Media Workshop\msvcr70.dll
  • %Program Files%\Aurora Media Workshop\NCTAudioRecord2.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\WNASPI32.DLL
  • %Program Files%\Aurora Media Workshop\is-5OJK2.tmp
  • %Program Files%\Aurora Media Workshop\AuroraMediaWorkshop.exe
  • %Program Files%\Aurora Media Workshop\setup.ini
  • %Program Files%\Aurora Media Workshop\is-IO1SG.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-FOGJ3.tmp
  • %Program Files%\Aurora Media Workshop\is-O53JL.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-VKC9J.tmp
  • %Program Files%\Aurora Media Workshop\is-0CK7O.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-BI7VF.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\WIN9X.REG
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop\Aurora Media Workshop.lnk
  • %Program Files%\Aurora Media Workshop\is-IVFNU.tmp
  • %Program Files%\Aurora Media Workshop\is-8K4AD.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-68DCF.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WINNT.REG
  • %Program Files%\Aurora Media Workshop\is-6BR8T.tmp
  • %Program Files%\Aurora Media Workshop\unins000.exe
  • %Program Files%\Aurora Media Workshop\vorbis.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-7RTD9.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-UPSE3.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\is-GAIJ1.tmp
  • %Program Files%\Aurora Media Workshop\is-DLDNF.tmp
  • %Program Files%\Aurora Media Workshop\is-12IRR.tmp
  • %Program Files%\Aurora Media Workshop\license.TXT
  • %Program Files%\Aurora Media Workshop\is-K15H3.tmp
  • %Program Files%\Aurora Media Workshop\is-S64LV.tmp
  • %Program Files%\Aurora Media Workshop\skin\is-NVQ4J.tmp
  • %Program Files%\Aurora Media Workshop\is-NJKIV.tmp
  • %Program Files%\Aurora Media Workshop\viscomimage.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-4FVV3.tmp
  • %Program Files%\Aurora Media Workshop\is-64AHV.tmp
  • %Program Files%\Aurora Media Workshop\is-UR68V.tmp
  • %Program Files%\Aurora Media Workshop\is-C9DF1.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-SGOLA.tmp
  • %User Temp%\fix150120.dat
  • %Program Files%\Aurora Media Workshop\is-F1MVR.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-UCC5P.tmp
  • %Program Files%\Aurora Media Workshop\is-VONCQ.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\ASPI32.SYS
  • %Program Files%\Aurora Media Workshop\is-M6TIC.tmp
  • %Program Files%\Aurora Media Workshop\mp3lib.dll
  • %Program Files%\Aurora Media Workshop\is-MBU4D.tmp
  • %Program Files%\Aurora Media Workshop\readme.TXT
  • %Program Files%\Aurora Media Workshop\mpeg2dmx.ax
  • %Program Files%\Aurora Media Workshop\is-I667T.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-N0HAN.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-FNFJ5.tmp
  • %Program Files%\Aurora Media Workshop\cdrip.dll
  • %Program Files%\Aurora Media Workshop\unins000.dat
  • %Program Files%\Aurora Media Workshop\skinmagic.dll
  • %Program Files%\Aurora Media Workshop\NCTAudioPlayer2.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WOWPOST.EXE
  • %Program Files%\Aurora Media Workshop\Help.CHM
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WINASPI.DLL
  • %Program Files%\Aurora Media Workshop\is-GN80O.tmp
  • %Program Files%\Google\Update\GoogleUpdate.exe
  • %Program Files%\Aurora Media Workshop\is-AHQ81.tmp
  • %Program Files%\Aurora Media Workshop\Support.ini
  • %Program Files%\Aurora Media Workshop\viscomwave.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-NQQKE.tmp
  • %Program Files%\Aurora Media Workshop\is-H7HJM.tmp
  • %Program Files%\Aurora Media Workshop\VideoEdit.ocx
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\APIX.VXD
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\WINASPI.DLL
  • %Program Files%\Aurora Media Workshop\WMVProfileEditor.ocx
  • %Program Files%\Aurora Media Workshop\msvcr71.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-6H70E.tmp
  • %System%\smd.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WNASPI32.DLL
  • %Program Files%\Aurora Media Workshop\is-6SLN6.tmp
  • %Program Files%\Aurora Media Workshop\wmaudsdk.dll
  • %Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll
  • %Program Files%\Aurora Media Workshop\is-71UQA.tmp
  • %Program Files%\Aurora Media Workshop\msvcrt.dll
  • %Program Files%\Aurora Media Workshop\lame_enc.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-HSFNB.tmp
  • %Program Files%\Aurora Media Workshop\Foxburner.dll
  • %Program Files%\Aurora Media Workshop\is-3JHS3.tmp
  • %Program Files%\Aurora Media Workshop\DirectEncode.dll
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-H29T1.tmp
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\ASPI32.SYS
  • %Program Files%\Aurora Media Workshop\mpgdec.ax

手順 5

以下のフォルダを検索し削除します。

[ 詳細 ]
フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X
  • %Program Files%\Aurora Media Workshop\skin
  • %Program Files%\Aurora Media Workshop\forceASPI17
  • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop
  • %User Temp%\is-V4OUL.tmp\_isetup
  • %Program Files%\Aurora Media Workshop
  • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT

手順 6

最新のバージョン(エンジン、パターンファイル)を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「Trojan.Win32.STASER.E」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 7

以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア/グレイウェア/スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop\Aurora Media Workshop.pif
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop\Aurora Media Workshop.url

手順 8

以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。

※註:マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。

  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • RegFilesHash
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • RegFiles0000
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • Sequence
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • SessionHash
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • Owner


ご利用はいかがでしたか? アンケートにご協力ください