Trend Micro Security

TrojanSpy.MSIL.ORCUS.D

2020年3月10日
 プラットフォーム:

Windows

 危険度:
 ダメージ度:
 感染力:
 感染確認数:
 システムへの影響:
 情報漏えい:


  • マルウェアタイプ: スパイウェア/情報窃取型
  • 破壊活動の有無: なし
  • 暗号化:  
  • 感染報告の有無: はい

  概要


スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 1,609,632 bytes
タイプ EXE
メモリ常駐 はい
発見日 2020年3月10日

侵入方法

スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

スパイウェアは、以下のプロセスを追加します。

  • %User Temp%\File.exe
  • "%System Root%/Users/ADMINI~1/AppData/Local/Temp/{malware file name}.exe"
  • "%Windows%\Temp\asw.4845fd0c85d8a167\avast_premier_antivirus_setup_online_x64.exe" /ga_clientid:{GUID} /edat_dir:%Windows%\Temp\asw.4845fd0c85d8a167
  • %Program Files%\HD Audio Driver\Audio Driver.exe
  • "%Windows%\Temp\asw.bfb3c42b5a5960b2\instup.exe" /edition:12 /ga_clientid:{GUID} /guid:{GUID} /prod:ais /sfx:lite /sfxstorage:%Windows%\Temp\asw.bfb3c42b5a5960b2 /ga_clientid:{GUID} /edat_dir:%Windows%\Temp\asw.4845fd0c85d8a167
  • "%System Root%/Program Files (x86)/HD Audio Driver/Audio Driver.exe"
  • "%Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\instup.exe" /edat_dir:%Windows%\Temp\asw.4845fd0c85d8a167 /edition:12 /ga_clientid:{GUID} /guid:{GUID} /online_installer /prod:ais /sfx /sfxstorage:%Windows%\Temp\asw.bfb3c42b5a5960b2
  • "%Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswOfferTool.exe" -checkChrome -elevated
  • "%Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFA
  • "%Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswOfferTool.exe" -checkGToolbar -elevated
  • "%Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswOfferTool.exe" /check_secure_browser
  • %System%\svchost.exe -k netsvcs
  • %Windows%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  • %System%\svchost.exe -k LocalServiceAndNoImpersonation
  • %Windows%\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  • %System%\sppsvc.exe
  • "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe"

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.. %Windows%フォルダは、Windowsが利用するフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows" です。.. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %System%フォルダは、システムフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows\System32" です。.)

スパイウェアは、以下のフォルダを作成します。

  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d
  • %Windows%\Temp\asw.4845fd0c85d8a167
  • %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft
  • %All Users Profile%\AVAST Software
  • \
  • %Windows%\Temp
  • \.\%All Users Profile%
  • %All Users Profile%\AVAST Software\Persistent Data
  • %All Users Profile%\AVAST Software\Avast\log
  • \.\%System Root%
  • %Program Files%\HD Audio Driver
  • %All Users Profile%\AVAST Software\Avast
  • \.
  • \.\%All Users Profile%\AVAST Software
  • %Windows%\Temp\asw.bfb3c42b5a5960b2
  • %All Users Profile%\AVAST Software\Persistent Data\Avast
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs
  • %All Users Profile%

(註：%Windows%フォルダは、Windowsが利用するフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows" です。.. %All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。. %System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。)

自動実行方法

スパイウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
HD Audio Driver = "%Program Files%\HD Audio Driver\Audio Driver.exe"

他のシステム変更

スパイウェアは、以下のファイルを削除します。

  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtapi_15731429843104.dll
  • %Windows%\Temp\asw.4845fd0c85d8a167
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtoolbar_setup_15731429872728.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtoolbar_setup_15731429862960.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\securebrowser_setup_15731429843104.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\chrome_setup_15731429832204.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\chrome_setup_15731429843104.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gcapi_15731429872728.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\securebrowser_setup_15731429862960.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtoolbar_setup_15731429832204.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtoolbar_setup_15731429843104.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\securebrowser_setup_15731429832204.exe
  • %User Temp%\FindMe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\chrome_setup_15731429872728.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\Sfx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtapi_15731429872728.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtapi_15731429832204.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\chrome_setup_15731429862960.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\securebrowser_setup_15731429872728.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gcapi_15731429862960.dll

(註：%Windows%フォルダは、Windowsが利用するフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows" です。.. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

スパイウェアは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
AVAST Software
SymbolicLinkValue = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
SfxInstProgress = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
SfxInstProgress = "100"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\partmgr
EnableCounterForIoctl = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\
Avast
SetupLog = "%All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\Setup.log"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Title = "Updating the product"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Main = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "DNS resolving"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "100"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "File downloaded: servers.def.vpx"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "File downloaded: prod-pgm.vpx"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Checking install conditions"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "6"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "8"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "9"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "10"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "11"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "12"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "13"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "14"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "15"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "16"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "17"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "18"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "19"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "20"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "21"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "22"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "23"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "24"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "25"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "26"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "27"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "28"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "29"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "30"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "31"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "33"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "34"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "35"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "36"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "37"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "38"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "39"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "40"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "41"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "42"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "43"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "44"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "45"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "46"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "47"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "48"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "49"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "50"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "51"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "52"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "53"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "54"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "55"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "56"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "57"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "58"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "59"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "60"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "61"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "62"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "63"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "64"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "65"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "66"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "67"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "68"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "69"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "71"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "72"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "73"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "74"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "75"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "76"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "77"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "78"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "79"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "80"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "81"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "82"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "83"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "84"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "85"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "86"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "87"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "88"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "89"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "90"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "91"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "92"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "93"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "94"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "95"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "96"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "97"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "98"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "99"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "File downloaded: avbugreport_x64_ais-95d.vpx"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Updating package: avbugreport_x64_ais"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Main = "12"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "70"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "File downloaded: avdump_x64_ais-95d.vpx"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Updating package: avdump_x64_ais"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Main = "25"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "File downloaded: avdump_x86_ais-95d.vpx"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Updating package: avdump_x86_ais"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Main = "37"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Updating package: instcont_x64_ais"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Main = "50"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Updating package: instup_x64_ais"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Main = "62"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "5"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Syncer = "7"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "File downloaded: offertool_x64_ais-95d.vpx"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Updating package: offertool_x64_ais"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Main = "75"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "File downloaded: sbr_x64_ais-95d.vpx"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Updating package: sbr_x64_ais"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Main = "87"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Updating package: setgui_x64_ais"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_UpdateSetup_Main = "100"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Extracting file: AvBugReport.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Extracting file: AvDump.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Extracting file: instup.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Extracting file: instup.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Extracting file: aswOfferTool.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Extracting file: sbr.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Extracting file: HTMLayout.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Description = "Replacing files"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Installation_Syncer = "100"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AvastPersistentStorage
InstupProgress_Installation_Main = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Google\GCAPITemp
test = "te"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Google\Google Toolbar
test = "test"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Google\No Toolbar Offer Until
AVAST Software = "20200507"

スパイウェアは、以下のレジストリキーを削除します。

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Google\GCAPITemp\test

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Google\Google Toolbar\test

作成活動

スパイウェアは、以下のファイルを作成します。

  • %Windows%\Temp\asw.bfb3c42b5a5960b2\servers.def.lkg
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\instup.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw5cb6aae4b36d99e9.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\Instup.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\servers.def.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswOfferTool.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\setgui_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\HTMLayout.dll
  • %Windows%\Temp\asw.4845fd0c85d8a167\avast_premier_antivirus_setup_online_x64.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-jrog2-12.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gcapi_15731429843104.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\offertool_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\avbugreport_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\avdump_x86_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\instup.exe
  • %User Temp%\svhost.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\vps.def
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw2c8afe51bc1890ce.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-prg_ais-1401095d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtapi_15731429862960.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\avdump_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\sbr_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\AvBugReport.exe.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\HTMLayout.dll.sum
  • %Program Files%\HD Audio Driver\Audio Driver.exe.config
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw7d81715b51843026.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\instup_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uat64.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswOfferTool.exe.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\%System Root%\Users\Public\Documents\aswOfferTool.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-vps_windows-20022300.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-setup_ais-1401095d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw75339f427e6e600c.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uat_1240.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\sbr.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\config.def.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\instcont_x64_ais-95d.vpx
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\Setup.log
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\servers.def
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\program.def
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw74e5779133adf449.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-jrog2-567.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\prod-pgm.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-vps_windows-20030399.vpx
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\event_manager.log
  • %All Users Profile%\Microsoft\Windows\DRM\v3ks.sec
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswb73d15fea0b33c14.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\Instup.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uat.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\avast5.ini
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\config.def
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\AvBugReport.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\sbr.exe.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uata64.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gcapi_15731429832204.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uat_3628.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\prod-vps.vpx
  • %AppDataLocal%\Microsoft\Media Player\CurrentDatabase_372.wmdb
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\AvDump.exe
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\event_manager.log.tmp.{GUID}
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\instup.exe.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\instup.dll.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\config.def.new
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\Setup.log.tmp.{GUID}
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw277e73d7a500a8c7.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\setup.def
  • %User Temp%\File.exe
  • %All Users Profile%\Microsoft\Windows\DRM\drmstore.hds
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\HTMLayout.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\AvDump.exe.sum
  • %Program Files%\HD Audio Driver\Audio Driver.exe

(註：%Windows%フォルダは、Windowsが利用するフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows" です。.. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.. %All Users Profile%フォルダは、ユーザの共通プロファイルフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\All Users” です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData” です。. %AppDataLocal%フォルダは、ローカルアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local" です。)

その他

スパイウェアは、以下の不正なWebサイトにアクセスします。

  • http://www.{BLOCKED}-analytics.com/collect
  • http://v7event.{BLOCKED}s.avast.com/cgi-bin/iavsevents.cgi
  • http://iavs9x.{BLOCKED}u.avast.com/iavs9x/avast_premi{BLOCKED}um_sec{BLOCKED}urity_set{BLOCKED}up_online_x64.exe
  • http://www.{BLOCKED}-analytics.com/collect?{random characters}
  • http://b4380882.{BLOCKED}x.u.avast.com/{BLOCKED}x/servers.def.vpx
  • http://b4380882.{BLOCKED}x.u.avast.com/{BLOCKED}x/prod-pgm.vpx
  • http://b4380882.{BLOCKED}x.u.avast.com/{BLOCKED}x/avbugreport_x64_ais-95d.vpx
  • http://b4380882.{BLOCKED}x.u.avast.com/{BLOCKED}x/avdump_x64_ais-95d.vpx
  • http://b4380882.{BLOCKED}x.u.avast.com/{BLOCKED}x/avdump_x86_ais-95d.vpx
  • http://b4380882.{BLOCKED}x.u.avast.com/{BLOCKED}x/offertool_x64_ais-95d.vpx
  • http://b4380882.{BLOCKED}x.u.avast.com/{BLOCKED}x/sbr_x64_ais-95d.vpx
  • http://g0679661.{BLOCKED}x.u.avast.com/{BLOCKED}x/prod-pgm.vpx
  • http://m5972635.{BLOCKED}iny.u.avcdn.net/{BLOCKED}iny/prod-vps.vpx
  • http://m5972635.{BLOCKED}iny.u.avcdn.net/{BLOCKED}iny/part-jrog2-12.vpx
  • http://m5972635.{BLOCKED}iny.u.avcdn.net/{BLOCKED}iny/part-vps_windows-20030399.vpx
  • http://shepherd.{BLOCKED}{BLOCKED}.avast.com
  • http://f3355109.{BLOCKED}x.u.avast.com
  • http://g5569634.{BLOCKED}x.u.avast.com
  • http://h1745978.{BLOCKED}x.u.avast.com
  • http://h6891735.{BLOCKED}x.u.avast.com
  • http://s-iavs9x.{BLOCKED}n.net
  • http://k8528219.{BLOCKED}x.u.avast.com
  • http://p3357684.{BLOCKED}x.u.avast.com
  • http://t7758057.{BLOCKED}x.u.avast.com
  • http://w5810700.{BLOCKED}x.u.avast.com
  • http://d4479313.{BLOCKED}iny.u.avcdn.net
  • http://l2350042.{BLOCKED}iny.u.avcdn.net
  • http://m9761227.{BLOCKED}iny.u.avcdn.net
  • http://s-vps18tiny.{BLOCKED}n.net
  • http://s0383910.{BLOCKED}iny.u.avcdn.net
  • http://alpha-license-dealer.{BLOCKED}{BLOCKED}.avast.com
  • http://alpha-iqs.{BLOCKED}{BLOCKED}.avast.com
  • http://ssl.{BLOCKED}-analytics.com
  • http://analytics.{BLOCKED}{BLOCKED}.avast.com
  • {BLOCKED}1.92.3

このウイルス情報は、自動解析システムにより作成されました。

  対応方法

対応検索エンジン: 9.850

手順 1

Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

Windowsをセーフモードで再起動します。

[ 詳細 ]

手順 3

「TrojanSpy.MSIL.ORCUS.D」で検出したファイル名を確認し、そのファイルを終了します。

[ 詳細 ]

  • すべての実行中プロセスが、Windows のタスクマネージャに表示されない場合があります。この場合、"Process Explorer" などのツールを使用しマルウェアのファイルを終了してください。"Process Explorer" については、こちらをご参照下さい。
  • 検出ファイルが、Windows のタスクマネージャまたは "Process Explorer" に表示されるものの、削除できない場合があります。この場合、コンピュータをセーフモードで再起動してください。
    セーフモードについては、こちらをご参照下さい。
  • 検出ファイルがタスクマネージャ上で表示されない場合、次の手順にお進みください。

手順 4

このレジストリ値を削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • HD Audio Driver = "%Program Files%\HD Audio Driver\Audio Driver.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVAST Software
    • SymbolicLinkValue = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • SfxInstProgress = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • SfxInstProgress = "100"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\partmgr
    • EnableCounterForIoctl = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\Avast
    • SetupLog = "%All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\Setup.log"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Title = "Updating the product"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Main = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "DNS resolving"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "100"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "File downloaded: servers.def.vpx"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "File downloaded: prod-pgm.vpx"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Checking install conditions"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "3"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "4"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "6"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "8"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "9"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "10"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "11"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "12"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "13"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "14"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "15"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "16"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "17"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "18"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "19"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "20"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "21"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "22"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "23"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "24"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "25"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "26"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "27"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "28"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "29"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "30"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "31"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "32"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "33"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "34"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "35"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "36"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "37"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "38"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "39"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "40"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "41"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "42"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "43"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "44"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "45"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "46"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "47"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "48"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "49"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "50"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "51"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "52"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "53"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "54"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "55"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "56"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "57"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "58"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "59"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "60"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "61"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "62"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "63"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "64"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "65"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "66"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "67"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "68"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "69"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "71"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "72"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "73"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "74"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "75"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "76"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "77"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "78"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "79"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "80"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "81"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "82"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "83"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "84"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "85"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "86"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "87"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "88"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "89"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "90"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "91"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "92"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "93"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "94"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "95"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "96"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "97"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "98"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "99"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "File downloaded: avbugreport_x64_ais-95d.vpx"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Updating package: avbugreport_x64_ais"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Main = "12"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "70"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "File downloaded: avdump_x64_ais-95d.vpx"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Updating package: avdump_x64_ais"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Main = "25"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "File downloaded: avdump_x86_ais-95d.vpx"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Updating package: avdump_x86_ais"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Main = "37"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Updating package: instcont_x64_ais"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Main = "50"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Updating package: instup_x64_ais"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Main = "62"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "5"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Syncer = "7"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "File downloaded: offertool_x64_ais-95d.vpx"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Updating package: offertool_x64_ais"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Main = "75"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "File downloaded: sbr_x64_ais-95d.vpx"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Updating package: sbr_x64_ais"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Main = "87"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Updating package: setgui_x64_ais"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_UpdateSetup_Main = "100"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Extracting file: AvBugReport.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Extracting file: AvDump.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Extracting file: instup.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Extracting file: instup.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Extracting file: aswOfferTool.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Extracting file: sbr.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Extracting file: HTMLayout.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Description = "Replacing files"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Installation_Syncer = "100"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
    • InstupProgress_Installation_Main = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\GCAPITemp
    • test = "te"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Google Toolbar
    • test = "test"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\No Toolbar Offer Until
    • AVAST Software = "20200507"

手順 5

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\servers.def.lkg
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\instup.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw5cb6aae4b36d99e9.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\Instup.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\servers.def.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswOfferTool.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\setgui_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\HTMLayout.dll
  • %Windows%\Temp\asw.4845fd0c85d8a167\avast_premier_antivirus_setup_online_x64.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-jrog2-12.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gcapi_15731429843104.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\offertool_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\avbugreport_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\avdump_x86_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\instup.exe
  • %User Temp%\svhost.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\vps.def
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw2c8afe51bc1890ce.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-prg_ais-1401095d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtapi_15731429862960.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\avdump_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\sbr_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\AvBugReport.exe.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\HTMLayout.dll.sum
  • %Program Files%\HD Audio Driver\Audio Driver.exe.config
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw7d81715b51843026.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\instup_x64_ais-95d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uat64.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswOfferTool.exe.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\%System Root%\Users\Public\Documents\aswOfferTool.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-vps_windows-20022300.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-setup_ais-1401095d.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw75339f427e6e600c.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uat_1240.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\sbr.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\config.def.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\instcont_x64_ais-95d.vpx
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\Setup.log
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\servers.def
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\program.def
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw74e5779133adf449.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-jrog2-567.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\prod-pgm.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\part-vps_windows-20030399.vpx
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\event_manager.log
  • %All Users Profile%\Microsoft\Windows\DRM\v3ks.sec
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\aswb73d15fea0b33c14.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\Instup.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uat.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\avast5.ini
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\config.def
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\AvBugReport.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\sbr.exe.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uata64.vpx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gcapi_15731429832204.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\uat_3628.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\prod-vps.vpx
  • %AppDataLocal%\Microsoft\Media Player\CurrentDatabase_372.wmdb
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\AvDump.exe
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\event_manager.log.tmp.{GUID}
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\instup.exe.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\instup.dll.sum
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\config.def.new
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs\Setup.log.tmp.{GUID}
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\asw277e73d7a500a8c7.tmp
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\setup.def
  • %User Temp%\File.exe
  • %All Users Profile%\Microsoft\Windows\DRM\drmstore.hds
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\HTMLayout.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\AvDump.exe.sum
  • %Program Files%\HD Audio Driver\Audio Driver.exe

手順 6

以下のフォルダを検索し削除します。

[ 詳細 ]
フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d
  • %Windows%\Temp\asw.4845fd0c85d8a167
  • %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft
  • %All Users Profile%\AVAST Software
  • \
  • %Windows%\Temp
  • \.\%All Users Profile%
  • %All Users Profile%\AVAST Software\Persistent Data
  • %All Users Profile%\AVAST Software\Avast\log
  • \.\%System Root%
  • %Program Files%\HD Audio Driver
  • %All Users Profile%\AVAST Software\Avast
  • \.
  • \.\%All Users Profile%\AVAST Software
  • %Windows%\Temp\asw.bfb3c42b5a5960b2
  • %All Users Profile%\AVAST Software\Persistent Data\Avast
  • %All Users Profile%\AVAST Software\Persistent Data\Avast\Logs
  • %All Users Profile%

手順 7

コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「TrojanSpy.MSIL.ORCUS.D」と検出したファイルの検索を実行してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 8

以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtapi_15731429843104.dll
  • %Windows%\Temp\asw.4845fd0c85d8a167
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtoolbar_setup_15731429872728.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtoolbar_setup_15731429862960.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\securebrowser_setup_15731429843104.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\chrome_setup_15731429832204.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\chrome_setup_15731429843104.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gcapi_15731429872728.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\securebrowser_setup_15731429862960.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtoolbar_setup_15731429832204.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtoolbar_setup_15731429843104.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\securebrowser_setup_15731429832204.exe
  • %User Temp%\FindMe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\chrome_setup_15731429872728.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\Sfx
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtapi_15731429872728.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gtapi_15731429832204.dll
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\chrome_setup_15731429862960.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\securebrowser_setup_15731429872728.exe
  • %Windows%\Temp\asw.bfb3c42b5a5960b2\New_1401095d\gcapi_15731429862960.dll

手順 9

以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。

※註：マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\GCAPITemp
    • test
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Google Toolbar
    • test


ご利用はいかがでしたか？　アンケートにご協力ください