Trend Micro Security

WORM_KAANEUT.A

2013年6月18日
 別名:

Trojan:Win32/Kaaneut.A, Trojan:Win32/Kaaneut.A (Microsoft); BackDoor-EE (McAfee); Backdoor.Mosuck (Symantec); PAK:UPX, Worm.Win32.Agent.aaj (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Dropped:Worm.Generic.238501 (FSecure)

 プラットフォーム:

Windows 2000, Windows XP, Windows Server 2003

 危険度:
 ダメージ度:
 感染力:
 感染確認数:


  • マルウェアタイプ: ワーム
  • 破壊活動の有無: なし
  • 暗号化:  
  • 感染報告の有無: はい

  概要


ワームは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 67,072 bytes
タイプ EXE
メモリ常駐 はい
発見日 2012年4月28日

侵入方法

ワームは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

ワームは、感染したコンピュータ内に以下のように自身のコピーを作成します。

  • %Program Files%\Windows Media Player\wmplayerc.exe
  • %System Root%\RÊCYCLÊR\  .com
  • %User Profile%\RÊCYCLÊR\  .com

ワームは、以下のフォルダを作成します。

  • %System Root%\Autorun.inf
  • %System Root%\RÊCYCLÊR
  • %User Profile%\My Documents\RÊCYCLÊR
  • %User Profile%\Microsoft\HTML Help

(註：%System Root%フォルダは、標準設定では "C:" です。また、オペレーティングシステムが存在する場所です。. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞" です。)

自動実行方法

ワームは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Media Player = "%Program Files%\Windows Media Player\wmplayerc.exe"

他のシステム変更

ワームは、以下のファイルを削除します。

  • %System Root%\Autorun.inf

(註：%System Root%フォルダは、標準設定では "C:" です。また、オペレーティングシステムが存在する場所です。)

ワームは、以下のレジストリキーを追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wscript.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
cscript.exe

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\
Default MidiOut Device

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\
Default DirectSound Device

HKEY_CURRENT_USER\Software\Microsoft\
Multimedia\ActiveMovie\Filter Cache

HKEY_CURRENT_USER\Software\Microsoft\
MediaPlayer\Setup\UserOptions

ワームは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirstRunDisabled = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DefaultValue = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wscript.exe
Debugger = "rundll32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
cscript.exe
Debugger = "rundll32.exe"

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\
Default MidiOut Device
FriendlyName = "Default MidiOut Device"

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\
Default MidiOut Device
CLSID = "{07B65360-C445-11CE-AFDE-00AA006C14F4}"

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\
Default MidiOut Device
FilterData = "{random values}"

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\
Default MidiOut Device
MidiOutId = "ffffffff"

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\
Default DirectSound Device
FriendlyName = "Default DirectSound Device"

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\
Default DirectSound Device
CLSID = "{79376820-07D0-11CF-A24D-0020AFD79767}"

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\
Default DirectSound Device
FilterData = "{random values}"

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\
Default DirectSound Device
DSGuid = "{00000000-0000-0000-0000-000000000000}"

HKEY_CURRENT_USER\Software\Microsoft\
Multimedia\ActiveMovie\Filter Cache
0 = "{random values}"

HKEY_CURRENT_USER\Software\Microsoft\
MediaPlayer\Preferences
MetadataRetrieval = "3"

HKEY_CURRENT_USER\Software\Microsoft\
MediaPlayer\Preferences
SendUserGUID = "{random values}"

HKEY_CURRENT_USER\Software\Microsoft\
MediaPlayer\Preferences
SilentAcquisition = "1"

HKEY_CURRENT_USER\Software\Microsoft\
MediaPlayer\Preferences
UsageTracking = "0"

HKEY_CURRENT_USER\Software\Microsoft\
MediaPlayer\Preferences
DisableMRU = "0"

HKEY_CURRENT_USER\Software\Microsoft\
MediaPlayer\Setup\UserOptions
DesktopShortcut = "yes"

HKEY_CURRENT_USER\Software\Microsoft\
MediaPlayer\Setup\UserOptions
QuickLaunchShortcut = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wma
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wax
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
audio/x-ms-wma
UserApprovedOwning = "yes"

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\User Trusted External Applications
%Program Files%\WINDOW~2\wmplayer.exe = "Yes"

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\User Trusted External Applications
%Program Files%\Windows Media Player\wmplayer.exe = "Yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
audio/x-ms-wax
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wmv
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wvx
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-wmv
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-wvx
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.asf
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.asx
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.dvr-ms
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wpl
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wm
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wmx
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wmd
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wmz
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
application/x-mplayer2
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
application/vnd.ms-wpl
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-asf
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-asf-plugin
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-wm
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-wmx
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
application/x-ms-wmd
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
application/x-ms-wmz
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Protocols\
mms
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Protocols\
mmst
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Protocols\
mmsu
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Protocols\
msbd
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.cda
UserApprovedOwning = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Devices\
AudioCD
UserApprovedOwning = "yes"

ワームは、以下のレジストリ値を変更します。

HKEY_CURRENT_USER\Control Panel\Desktop
AutoEndTasks = "1"

(註：変更前の上記レジストリ値は、「0」となります。)

HKEY_CURRENT_USER\Control Panel\Desktop
HungAppTimeout = "111"

(註：変更前の上記レジストリ値は、「5000」となります。)

HKEY_CURRENT_USER\Control Panel\Desktop
WaitToKillAppTimeout = "111"

(註：変更前の上記レジストリ値は、「20000」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirstRunDisabled = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\HideFileExt
DefaultValue = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control
WaitToKillServiceTimeout = "1000"

(註：変更前の上記レジストリ値は、「20000」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SuperHidden = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MediaPlayer
MP2.SaveDir = "%Program Files%\Windows Media Player"

(註：変更前の上記レジストリ値は、「%Program Files%\Windows Media Player」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
MediaPlayer\Preferences
AcceptedPrivacyStatement = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
Action = "@wmploc.dll,-6503"

(註：変更前の上記レジストリ値は、「@wmploc.dll,-6503」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
Provider = "@wmploc.dll,-6502"

(註：変更前の上記レジストリ値は、「@wmploc.dll,-6502」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
InvokeProgID = "WMP.AudioCD"

(註：変更前の上記レジストリ値は、「WMP.AudioCD」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
InvokeVerb = "play"

(註：変更前の上記レジストリ値は、「play」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
Action = "@wmploc.dll,-6506"

(註：変更前の上記レジストリ値は、「@wmploc.dll,-6506」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
Provider = "@wmploc.dll,-6502"

(註：変更前の上記レジストリ値は、「@wmploc.dll,-6502」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
InvokeProgID = "WMP.RipCD"

(註：変更前の上記レジストリ値は、「WMP.RipCD」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
InvokeVerb = "Rip"

(註：変更前の上記レジストリ値は、「Rip」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
Action = "@wmploc.dll,-6505"

(註：変更前の上記レジストリ値は、「@wmploc.dll,-6505」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
Provider = "@wmploc.dll,-6502"

(註：変更前の上記レジストリ値は、「@wmploc.dll,-6502」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
InvokeProgID = "WMP.BurnCD"

(註：変更前の上記レジストリ値は、「WMP.BurnCD」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
InvokeVerb = "Burn"

(註：変更前の上記レジストリ値は、「Burn」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
Action = "@wmploc.dll,-6504"

(註：変更前の上記レジストリ値は、「@wmploc.dll,-6504」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
Provider = "@wmploc.dll,-6502"

(註：変更前の上記レジストリ値は、「@wmploc.dll,-6502」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
InvokeProgID = "WMP.DVD"

(註：変更前の上記レジストリ値は、「WMP.DVD」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
InvokeVerb = "play"

(註：変更前の上記レジストリ値は、「play」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMDMHandler
Action = "Transfer Files"

(註：変更前の上記レジストリ値は、「Transfer Files」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMDMHandler
CLSIDForCancel = "{91778246-9BE4-4713-A651-E833B853CC30}"

(註：変更前の上記レジストリ値は、「{91778246-9BE4-4713-A651-E833B853CC30}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMDMHandler
DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMDMHandler
InitCmdLine = "%ProgramFiles%\Windows Media Player\wmplayer.exe /prefetch:3 /task:PortableDevice"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMDMHandler
ProgID = "Shell.HWEventHandlerShellExecute"

(註：変更前の上記レジストリ値は、「Shell.HWEventHandlerShellExecute」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
AutoplayHandlers\Handlers\MSWMDMHandler
Provider = "@wmploc.dll,-6502"

(註：変更前の上記レジストリ値は、「@wmploc.dll,-6502」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wma\OpenWithProgIds
WMAFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
wmafile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
wmafile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
wmafile\shell\open\
DropTarget
CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"

(註：変更前の上記レジストリ値は、「{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
wmafile\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wma
Content Type = "audio/x-ms-wma"

(註：変更前の上記レジストリ値は、「audio/x-ms-wma」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.wma
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wma
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wax\OpenWithProgIds
WAXFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WAXFile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WAXFile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WAXFile\shell\open\
DropTarget
CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"

(註：変更前の上記レジストリ値は、「{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WAXFile\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wax
Content Type = "audio/x-ms-wax"

(註：変更前の上記レジストリ値は、「audio/x-ms-wax」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.wax
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wax
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Suffixes
audio/x-ms-wma = "wma"

(註：変更前の上記レジストリ値は、「wma」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
TYPE17 = "audio/x-ms-wma"

(註：変更前の上記レジストリ値は、「audio/x-ms-wma」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
audio/x-ms-wma = "%Program Files%\WINDOW~2\wmplayer.exe"

(註：変更前の上記レジストリ値は、「"%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
audio/x-ms-wma
CLSID = "{cd3afa84-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa84-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
audio/x-ms-wma
Extension = ".wma"

(註：変更前の上記レジストリ値は、「.wma」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
audio/x-ms-wma
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Suffixes
audio/x-ms-wax = "wax"

(註：変更前の上記レジストリ値は、「wax」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
TYPE16 = "audio/x-ms-wax"

(註：変更前の上記レジストリ値は、「audio/x-ms-wax」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
audio/x-ms-wax = "%Program Files%\WINDOW~2\wmplayer.exe"

(註：変更前の上記レジストリ値は、「"%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
audio/x-ms-wax
CLSID = "{cd3afa83-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa83-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
audio/x-ms-wax
Extension = ".wax"

(註：変更前の上記レジストリ値は、「.wax」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
audio/x-ms-wax
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmv\OpenWithProgIds
WMVFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMVFile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMVFile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMVFile\shell\open\
DropTarget
CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"

(註：変更前の上記レジストリ値は、「{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMVFile\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmv
Content Type = "video/x-ms-wmv"

(註：変更前の上記レジストリ値は、「video/x-ms-wmv」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.wmv
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wmv
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wvx\OpenWithProgIds
WVXFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WVXFile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WVXFile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WVXFile\shell\open\
DropTarget
CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"

(註：変更前の上記レジストリ値は、「{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WVXFile\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wvx
Content Type = "video/x-ms-wvx"

(註：変更前の上記レジストリ値は、「video/x-ms-wvx」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.wvx
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wvx
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Suffixes
video/x-ms-wmv = "wmv"

(註：変更前の上記レジストリ値は、「wmv」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
TYPE29 = "video/x-ms-wmv"

(註：変更前の上記レジストリ値は、「video/x-ms-wmv」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
video/x-ms-wmv = "%Program Files%\WINDOW~2\wmplayer.exe"

(註：変更前の上記レジストリ値は、「"%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-wmv
CLSID = "{cd3afa94-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa94-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-wmv
Extension = ".wmv"

(註：変更前の上記レジストリ値は、「.wmv」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-wmv
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Suffixes
video/x-ms-wvx = "wvx"

(註：変更前の上記レジストリ値は、「wvx」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
TYPE31 = "video/x-ms-wvx"

(註：変更前の上記レジストリ値は、「video/x-ms-wvx」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
video/x-ms-wvx = "%Program Files%\WINDOW~2\wmplayer.exe"

(註：変更前の上記レジストリ値は、「"%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-wvx
CLSID = "{cd3afa95-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa95-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-wvx
Extension = ".wvx"

(註：変更前の上記レジストリ値は、「.wvx」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-wvx
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.asf\OpenWithProgIds
ASFFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ASFFile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ASFFile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ASFFile\shell\open\
DropTarget
CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"

(註：変更前の上記レジストリ値は、「{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ASFFile\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.asf
Content Type = "video/x-ms-asf"

(註：変更前の上記レジストリ値は、「video/x-ms-asf」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.asf
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.asf
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.asx\OpenWithProgIds
ASXFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ASXFile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ASXFile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ASXFile\shell\open\
DropTarget
CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"

(註：変更前の上記レジストリ値は、「{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ASXFile\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.asx
Content Type = "video/x-ms-asf"

(註：変更前の上記レジストリ値は、「video/x-ms-asf」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.asx
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.asx
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.dvr-ms\OpenWithProgIds
WMP.DVR-MSFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMP.DVR-MSFile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMP.DVR-MSFile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMP.DVR-MSFile\shell\open\
DropTarget
CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"

(註：変更前の上記レジストリ値は、「{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMP.DVR-MSFile\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.dvr-ms
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wpl\OpenWithProgIds
WPLFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WPLFile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WPLFile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WPLFile\shell\open\
DropTarget
CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"

(註：変更前の上記レジストリ値は、「{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WPLFile\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wpl
Content Type = "application/vnd.ms-wpl"

(註：変更前の上記レジストリ値は、「application/vnd.ms-wpl」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.wpl
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wpl
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wm\OpenWithProgIds
ASFFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wm
Content Type = "video/x-ms-wm"

(註：変更前の上記レジストリ値は、「video/x-ms-wm」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.wm
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wm
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmx\OpenWithProgIds
ASXFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmx
Content Type = "video/x-ms-wmx"

(註：変更前の上記レジストリ値は、「video/x-ms-wmx」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.wmx
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wmx
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmd\OpenWithProgIds
WMDFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMDFile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMDFile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmd
Content Type = "application/x-ms-wmd"

(註：変更前の上記レジストリ値は、「application/x-ms-wmd」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.wmd
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wmd
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmz\OpenWithProgIds
WMZFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMZFile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
WMZFile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.wmz
Content Type = "application/x-ms-wmz"

(註：変更前の上記レジストリ値は、「application/x-ms-wmz」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\EmbedExtnToClsidMappings\.wmz
MPlayer2.Set = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.wmz
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-mplayer2
CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa8f-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-mplayer2
Extension = ".asx"

(註：変更前の上記レジストリ値は、「.asx」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
application/x-mplayer2
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/vnd.ms-wpl
CLSID = "{cd3afa95-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa95-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/vnd.ms-wpl
Extension = ".wpl"

(註：変更前の上記レジストリ値は、「.wpl」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
application/vnd.ms-wpl
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Suffixes
video/x-ms-asf = "asf,asx,wm,wmx"

(註：変更前の上記レジストリ値は、「asf,asx,wm,wmx」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
TYPE26 = "video/x-ms-asf"

(註：変更前の上記レジストリ値は、「video/x-ms-asf」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
video/x-ms-asf = "%Program Files%\WINDOW~2\wmplayer.exe"

(註：変更前の上記レジストリ値は、「"%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-asf
CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa8f-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-asf
Extension = ".asx"

(註：変更前の上記レジストリ値は、「.asx」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-asf
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Suffixes
video/x-ms-asf-plugin = "asf,asx,wm,wmx"

(註：変更前の上記レジストリ値は、「asf,asx,wm,wmx」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
TYPE27 = "video/x-ms-asf-plugin"

(註：変更前の上記レジストリ値は、「video/x-ms-asf-plugin」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
video/x-ms-asf-plugin = "%Program Files%\WINDOW~2\wmplayer.exe"

(註：変更前の上記レジストリ値は、「"%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-asf-plugin
CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa8f-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-asf-plugin
Extension = ".asx"

(註：変更前の上記レジストリ値は、「.asx」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-asf-plugin
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Suffixes
video/x-ms-wm = "asf,asx,wm,wmx"

(註：変更前の上記レジストリ値は、「asf,asx,wm,wmx」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
TYPE28 = "video/x-ms-wm"

(註：変更前の上記レジストリ値は、「video/x-ms-wm」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
video/x-ms-wm = "%Program Files%\WINDOW~2\wmplayer.exe"

(註：変更前の上記レジストリ値は、「"%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-wm
CLSID = "{cd3afa92-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa92-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-wm
Extension = ".wm"

(註：変更前の上記レジストリ値は、「.wm」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-wm
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Suffixes
video/x-ms-wmx = "asf,asx,wm,wmx"

(註：変更前の上記レジストリ値は、「asf,asx,wm,wmx」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
TYPE30 = "video/x-ms-wmx"

(註：変更前の上記レジストリ値は、「video/x-ms-wmx」となります。)

HKEY_CURRENT_USER\Software\Netscape\
Netscape Navigator\Viewers
video/x-ms-wmx = "%Program Files%\WINDOW~2\wmplayer.exe"

(註：変更前の上記レジストリ値は、「"%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-wmx
CLSID = "{cd3afa93-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa93-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
video/x-ms-wmx
Extension = ".wmx"

(註：変更前の上記レジストリ値は、「.wmx」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
video/x-ms-wmx
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-ms-wmd
CLSID = "{ee4da6a4-8c52-4a63-bbb8-97c93d7e1b6c}"

(註：変更前の上記レジストリ値は、「{ee4da6a4-8c52-4a63-bbb8-97c93d7e1b6c}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-ms-wmd
Extension = ".wmd"

(註：変更前の上記レジストリ値は、「.wmd」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
application/x-ms-wmd
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-ms-wmz
CLSID = "{cd3afa71-b84f-48f0-9393-7edc34128127}"

(註：変更前の上記レジストリ値は、「{cd3afa71-b84f-48f0-9393-7edc34128127}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-ms-wmz
Extension = ".wmz"

(註：変更前の上記レジストリ値は、「.wmz」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\MIME Types\
application/x-ms-wmz
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MMS
Source Filter = "{6B6D0800-9ADA-11d0-A520-00A0D10129C0}"

(註：変更前の上記レジストリ値は、「{6B6D0800-9ADA-11d0-A520-00A0D10129C0}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Protocols\
mms
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MMST
Source Filter = "{6B6D0800-9ADA-11d0-A520-00A0D10129C0}"

(註：変更前の上記レジストリ値は、「{6B6D0800-9ADA-11d0-A520-00A0D10129C0}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Protocols\
mmst
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MMSU
Source Filter = "{6B6D0800-9ADA-11d0-A520-00A0D10129C0}"

(註：変更前の上記レジストリ値は、「{6B6D0800-9ADA-11d0-A520-00A0D10129C0}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Protocols\
mmsu
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MSBD
Source Filter = "{6B6D0800-9ADA-11d0-A520-00A0D10129C0}"

(註：変更前の上記レジストリ値は、「{6B6D0800-9ADA-11d0-A520-00A0D10129C0}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Protocols\
msbd
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.cda\OpenWithProgIds
CDAFile = "[REG_NONE, size: 0 bytes]"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
cdafile
PreferExecuteOnMismatch = "1"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
cdafile
EditFlags = "{random values}"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
cdafile\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Extensions\
.cda
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AudioCD\shell\play
MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Multimedia\WMPlayer\Devices\
AudioCD
AlreadyRegistered = "yes"

(註：変更前の上記レジストリ値は、「yes」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DirectDraw\MostRecentApplication
Name = "iexplore.exe"

(註：変更前の上記レジストリ値は、「iexplore.exe」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DirectDraw\MostRecentApplication
ID = "4117b81"

(註：変更前の上記レジストリ値は、「41107b81」となります。)

ワームは、以下のレジストリキーを削除します。

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\eLoggerSvc6

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Norman ZANDA

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Norman NJeeves

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NPFSvc32

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NPROSECSVC

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NVOY

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NVCScheduler

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\nvcoas

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NUAA

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NPC

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NOD32krn

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\nod32drv

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\eamon

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ekrn

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\easdrv

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\EhttpSrv

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\epfwtdir

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\MUILanguages\
FileVersions

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.wma

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\audio/x-ms-wma

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.wma

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\audio/x-ms-wma

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.wax

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\audio/x-ms-wax

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.wax

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\audio/x-ms-wax

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.wmv

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\video/x-ms-wmv

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.wmv

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\video/x-ms-wmv

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.wvx

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\video/x-ms-wvx

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.wvx

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\video/x-ms-wvx

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.asf

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\video/x-ms-asf

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.asf

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\video/x-ms-asf

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.asx

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.asx

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.wpl

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\application/vnd.ms-wpl

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.wpl

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\application/vnd.ms-wpl

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.wm

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\video/x-ms-wm

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.wm

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\video/x-ms-wm

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.wmx

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\video/x-ms-wmx

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.wmx

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\video/x-ms-wmx

HKEY_CLASSES_ROOT\WMDFile\shellex\
ContextMenuHandlers\WMPPlayAsPlaylist

HKEY_CLASSES_ROOT\WMDFile\shellex\
ContextMenuHandlers\WMPAddToPlaylist

HKEY_CLASSES_ROOT\WMDFile\shellex\
ContextMenuHandlers\WMPBurnAudioCD

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.wmd

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\application/x-ms-wmd

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.wmd

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\application/x-ms-wmd

HKEY_CLASSES_ROOT\WMZFile\shellex\
ContextMenuHandlers\WMPPlayAsPlaylist

HKEY_CLASSES_ROOT\WMZFile\shellex\
ContextMenuHandlers\WMPAddToPlaylist

HKEY_CLASSES_ROOT\WMZFile\shellex\
ContextMenuHandlers\WMPBurnAudioCD

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\.wmz

HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\
EnablePlugin\MIME\application/x-ms-wmz

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\.wmz

HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\
EnablePlugin\MIME\application/x-ms-wmz

HKEY_CLASSES_ROOT\CDAFile\shellex\
ContextMenuHandlers\WMPPlayAsPlaylist

HKEY_CLASSES_ROOT\CDAFile\shellex\
ContextMenuHandlers\WMPAddToPlaylist

HKEY_CLASSES_ROOT\CDAFile\shellex\
ContextMenuHandlers\WMPBurnAudioCD

作成活動

ワームは、以下のファイルを作成します。

  • %System Root%\Documents and Settings.lnk
  • %Program Files%.lnk
  • %Windows%.lnk
  • %User Profile%\My Documents\My Music.lnk
  • %User Profile%\My Documents\My Pictures.lnk
  • %User Profile%\HTML Help\hh.dat
  • %Program Files%\Windows Media Player\wmplayerc.exe

(註：%System Root%フォルダは、標準設定では "C:" です。また、オペレーティングシステムが存在する場所です。. %Program Files%フォルダは、Windows 2000、Server 2003、XP (32ビット)、通常 Vista (32ビット) および 7 (32ビット) の場合、通常 "C:\Program Files"、Windows XP (64ビット)、Vista (64ビット) および 7 (64ビット) の場合、通常 "C:\Program Files (x86)" です。. %Windows%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では、"C:\Windows" です。. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞" です。)

このウイルス情報は、自動解析システムにより作成されました。

  対応方法

対応検索エンジン: 9.200

手順 1

Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

Windowsをセーフモードで再起動します。

[ 詳細 ]

手順 3

このレジストリキーを削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • Svc
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
    • System
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
    • wscript.exe
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
    • cscript.exe
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum
    • {4EFE2452-168A-11D1-BC76-00C04FB9453B}
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}
    • Default MidiOut Device
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum
    • {E0F158E1-CB04-11D0-BD4E-00A0C911CE86}
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}
    • Default DirectSound Device
  • In HKEY_CURRENT_USER\Software\Microsoft\Multimedia\ActiveMovie
    • Filter Cache
  • In HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Setup
    • UserOptions

手順 4

このレジストリ値を削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Windows Media Player = "%Program Files%\Windows Media Player\wmplayerc.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
    • EnableLUA = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UacDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • AntiVirusOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • AntiVirusDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • FirewallDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • FirewallOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • UpdatesDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • UacDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • FirstRunDisabled = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
    • DefaultValue = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • ShowSuperHidden = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe
    • Debugger = "rundll32.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe
    • Debugger = "rundll32.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
    • FriendlyName = "Default MidiOut Device"
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
    • CLSID = "{07B65360-C445-11CE-AFDE-00AA006C14F4}"
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
    • FilterData = "{random values}"
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
    • MidiOutId = "ffffffff"
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device
    • FriendlyName = "Default DirectSound Device"
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device
    • CLSID = "{79376820-07D0-11CF-A24D-0020AFD79767}"
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device
    • FilterData = "{random values}"
  • In HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device
    • DSGuid = "{00000000-0000-0000-0000-000000000000}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache
    • 0 = "{random values}"
  • In HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences
    • MetadataRetrieval = "3"
  • In HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences
    • SendUserGUID = "{random values}"
  • In HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences
    • SilentAcquisition = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences
    • UsageTracking = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences
    • DisableMRU = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Setup\UserOptions
    • DesktopShortcut = "yes"
  • In HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Setup\UserOptions
    • QuickLaunchShortcut = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wma
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wax
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-ms-wma
    • UserApprovedOwning = "yes"
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\User Trusted External Applications
    • %Program Files%\WINDOW~2\wmplayer.exe = "Yes"
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\User Trusted External Applications
    • %Program Files%\Windows Media Player\wmplayer.exe = "Yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-ms-wax
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmv
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wvx
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wmv
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wvx
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.asf
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.asx
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dvr-ms
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wpl
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wm
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmx
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmd
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmz
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-mplayer2
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/vnd.ms-wpl
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-asf
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-asf-plugin
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wm
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wmx
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-ms-wmd
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-ms-wmz
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mms
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mmst
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mmsu
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\msbd
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.cda
    • UserApprovedOwning = "yes"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Devices\AudioCD
    • UserApprovedOwning = "yes"

手順 5

変更されたレジストリ値を修正します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_CURRENT_USER\Control Panel\Desktop
    • From: AutoEndTasks = "1"
      To: AutoEndTasks = ""0""
  • In HKEY_CURRENT_USER\Control Panel\Desktop
    • From: HungAppTimeout = "111"
      To: HungAppTimeout = ""5000""
  • In HKEY_CURRENT_USER\Control Panel\Desktop
    • From: WaitToKillAppTimeout = "111"
      To: WaitToKillAppTimeout = ""20000""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
    • DisableSR = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UpdatesDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • From: FirstRunDisabled = "1"
      To: FirstRunDisabled = ""1""
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • From: HideFileExt = "1"
      To: HideFileExt = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
    • From: DefaultValue = "1"
      To: DefaultValue = ""1""
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control
    • From: WaitToKillServiceTimeout = "1000"
      To: WaitToKillServiceTimeout = ""20000""
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • SuperHidden = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer
    • From: MP2.SaveDir = "%Program Files%\Windows Media Player"
      To: MP2.SaveDir = ""%Program Files%\Windows Media Player""
  • In HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences
    • AcceptedPrivacyStatement = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
    • From: Action = "@wmploc.dll,-6503"
      To: Action = ""@wmploc.dll,-6503""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
    • From: Provider = "@wmploc.dll,-6502"
      To: Provider = ""@wmploc.dll,-6502""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
    • From: InvokeProgID = "WMP.AudioCD"
      To: InvokeProgID = ""WMP.AudioCD""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
    • From: InvokeVerb = "play"
      To: InvokeVerb = ""play""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival
    • From: DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"
      To: DefaultIcon = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
    • From: Action = "@wmploc.dll,-6506"
      To: Action = ""@wmploc.dll,-6506""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
    • From: Provider = "@wmploc.dll,-6502"
      To: Provider = ""@wmploc.dll,-6502""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
    • From: InvokeProgID = "WMP.RipCD"
      To: InvokeProgID = ""WMP.RipCD""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
    • From: InvokeVerb = "Rip"
      To: InvokeVerb = ""Rip""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSRipCDAudioOnArrival
    • From: DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"
      To: DefaultIcon = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
    • From: Action = "@wmploc.dll,-6505"
      To: Action = ""@wmploc.dll,-6505""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
    • From: Provider = "@wmploc.dll,-6502"
      To: Provider = ""@wmploc.dll,-6502""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
    • From: InvokeProgID = "WMP.BurnCD"
      To: InvokeProgID = ""WMP.BurnCD""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
    • From: InvokeVerb = "Burn"
      To: InvokeVerb = ""Burn""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival
    • From: DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"
      To: DefaultIcon = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
    • From: Action = "@wmploc.dll,-6504"
      To: Action = ""@wmploc.dll,-6504""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
    • From: Provider = "@wmploc.dll,-6502"
      To: Provider = ""@wmploc.dll,-6502""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
    • From: InvokeProgID = "WMP.DVD"
      To: InvokeProgID = ""WMP.DVD""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
    • From: InvokeVerb = "play"
      To: InvokeVerb = ""play""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival
    • From: DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"
      To: DefaultIcon = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMDMHandler
    • From: Action = "Transfer Files"
      To: Action = ""Transfer Files""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMDMHandler
    • From: CLSIDForCancel = "{91778246-9BE4-4713-A651-E833B853CC30}"
      To: CLSIDForCancel = ""{91778246-9BE4-4713-A651-E833B853CC30}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMDMHandler
    • From: DefaultIcon = "%ProgramFiles%\Windows Media Player\wmplayer.exe,0"
      To: DefaultIcon = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMDMHandler
    • From: InitCmdLine = "%ProgramFiles%\Windows Media Player\wmplayer.exe /prefetch:3 /task:PortableDevice"
      To: InitCmdLine = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMDMHandler
    • From: ProgID = "Shell.HWEventHandlerShellExecute"
      To: ProgID = ""Shell.HWEventHandlerShellExecute""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMDMHandler
    • From: Provider = "@wmploc.dll,-6502"
      To: Provider = ""@wmploc.dll,-6502""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wma\OpenWithProgIds
    • From: WMAFile = "[REG_NONE, size: 0 bytes]"
      To: WMAFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmafile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmafile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmafile\shell\open\DropTarget
    • From: CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"
      To: CLSID = ""{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmafile\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wma
    • From: Content Type = "audio/x-ms-wma"
      To: Content Type = ""audio/x-ms-wma""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wma
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wma
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wax\OpenWithProgIds
    • From: WAXFile = "[REG_NONE, size: 0 bytes]"
      To: WAXFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WAXFile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WAXFile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WAXFile\shell\open\DropTarget
    • From: CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"
      To: CLSID = ""{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WAXFile\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wax
    • From: Content Type = "audio/x-ms-wax"
      To: Content Type = ""audio/x-ms-wax""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wax
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wax
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Suffixes
    • From: audio/x-ms-wma = "wma"
      To: audio/x-ms-wma = ""wma""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: TYPE17 = "audio/x-ms-wma"
      To: TYPE17 = ""audio/x-ms-wma""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: audio/x-ms-wma = "%Program Files%\WINDOW~2\wmplayer.exe"
      To: audio/x-ms-wma = """%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wma
    • From: CLSID = "{cd3afa84-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa84-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wma
    • From: Extension = ".wma"
      To: Extension = "".wma""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-ms-wma
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Suffixes
    • From: audio/x-ms-wax = "wax"
      To: audio/x-ms-wax = ""wax""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: TYPE16 = "audio/x-ms-wax"
      To: TYPE16 = ""audio/x-ms-wax""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: audio/x-ms-wax = "%Program Files%\WINDOW~2\wmplayer.exe"
      To: audio/x-ms-wax = """%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wax
    • From: CLSID = "{cd3afa83-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa83-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wax
    • From: Extension = ".wax"
      To: Extension = "".wax""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-ms-wax
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmv\OpenWithProgIds
    • From: WMVFile = "[REG_NONE, size: 0 bytes]"
      To: WMVFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMVFile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMVFile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMVFile\shell\open\DropTarget
    • From: CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"
      To: CLSID = ""{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMVFile\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmv
    • From: Content Type = "video/x-ms-wmv"
      To: Content Type = ""video/x-ms-wmv""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmv
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmv
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wvx\OpenWithProgIds
    • From: WVXFile = "[REG_NONE, size: 0 bytes]"
      To: WVXFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WVXFile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WVXFile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WVXFile\shell\open\DropTarget
    • From: CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"
      To: CLSID = ""{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WVXFile\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wvx
    • From: Content Type = "video/x-ms-wvx"
      To: Content Type = ""video/x-ms-wvx""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wvx
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wvx
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Suffixes
    • From: video/x-ms-wmv = "wmv"
      To: video/x-ms-wmv = ""wmv""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: TYPE29 = "video/x-ms-wmv"
      To: TYPE29 = ""video/x-ms-wmv""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: video/x-ms-wmv = "%Program Files%\WINDOW~2\wmplayer.exe"
      To: video/x-ms-wmv = """%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmv
    • From: CLSID = "{cd3afa94-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa94-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmv
    • From: Extension = ".wmv"
      To: Extension = "".wmv""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wmv
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Suffixes
    • From: video/x-ms-wvx = "wvx"
      To: video/x-ms-wvx = ""wvx""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: TYPE31 = "video/x-ms-wvx"
      To: TYPE31 = ""video/x-ms-wvx""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: video/x-ms-wvx = "%Program Files%\WINDOW~2\wmplayer.exe"
      To: video/x-ms-wvx = """%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wvx
    • From: CLSID = "{cd3afa95-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa95-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wvx
    • From: Extension = ".wvx"
      To: Extension = "".wvx""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wvx
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asf\OpenWithProgIds
    • From: ASFFile = "[REG_NONE, size: 0 bytes]"
      To: ASFFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASFFile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASFFile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASFFile\shell\open\DropTarget
    • From: CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"
      To: CLSID = ""{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASFFile\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asf
    • From: Content Type = "video/x-ms-asf"
      To: Content Type = ""video/x-ms-asf""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.asf
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.asf
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asx\OpenWithProgIds
    • From: ASXFile = "[REG_NONE, size: 0 bytes]"
      To: ASXFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASXFile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASXFile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASXFile\shell\open\DropTarget
    • From: CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"
      To: CLSID = ""{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASXFile\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asx
    • From: Content Type = "video/x-ms-asf"
      To: Content Type = ""video/x-ms-asf""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.asx
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.asx
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dvr-ms\OpenWithProgIds
    • From: WMP.DVR-MSFile = "[REG_NONE, size: 0 bytes]"
      To: WMP.DVR-MSFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\open\DropTarget
    • From: CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"
      To: CLSID = ""{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dvr-ms
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wpl\OpenWithProgIds
    • From: WPLFile = "[REG_NONE, size: 0 bytes]"
      To: WPLFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WPLFile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WPLFile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WPLFile\shell\open\DropTarget
    • From: CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"
      To: CLSID = ""{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WPLFile\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wpl
    • From: Content Type = "application/vnd.ms-wpl"
      To: Content Type = ""application/vnd.ms-wpl""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wpl
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wpl
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wm\OpenWithProgIds
    • From: ASFFile = "[REG_NONE, size: 0 bytes]"
      To: ASFFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wm
    • From: Content Type = "video/x-ms-wm"
      To: Content Type = ""video/x-ms-wm""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wm
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wm
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmx\OpenWithProgIds
    • From: ASXFile = "[REG_NONE, size: 0 bytes]"
      To: ASXFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmx
    • From: Content Type = "video/x-ms-wmx"
      To: Content Type = ""video/x-ms-wmx""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmx
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmx
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmd\OpenWithProgIds
    • From: WMDFile = "[REG_NONE, size: 0 bytes]"
      To: WMDFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMDFile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMDFile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmd
    • From: Content Type = "application/x-ms-wmd"
      To: Content Type = ""application/x-ms-wmd""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmd
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmd
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmz\OpenWithProgIds
    • From: WMZFile = "[REG_NONE, size: 0 bytes]"
      To: WMZFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMZFile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMZFile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmz
    • From: Content Type = "application/x-ms-wmz"
      To: Content Type = ""application/x-ms-wmz""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmz
    • From: MPlayer2.Set = "yes"
      To: MPlayer2.Set = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmz
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mplayer2
    • From: CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa8f-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mplayer2
    • From: Extension = ".asx"
      To: Extension = "".asx""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-mplayer2
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-wpl
    • From: CLSID = "{cd3afa95-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa95-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-wpl
    • From: Extension = ".wpl"
      To: Extension = "".wpl""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/vnd.ms-wpl
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Suffixes
    • From: video/x-ms-asf = "asf,asx,wm,wmx"
      To: video/x-ms-asf = ""asf,asx,wm,wmx""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: TYPE26 = "video/x-ms-asf"
      To: TYPE26 = ""video/x-ms-asf""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: video/x-ms-asf = "%Program Files%\WINDOW~2\wmplayer.exe"
      To: video/x-ms-asf = """%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf
    • From: CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa8f-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf
    • From: Extension = ".asx"
      To: Extension = "".asx""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-asf
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Suffixes
    • From: video/x-ms-asf-plugin = "asf,asx,wm,wmx"
      To: video/x-ms-asf-plugin = ""asf,asx,wm,wmx""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: TYPE27 = "video/x-ms-asf-plugin"
      To: TYPE27 = ""video/x-ms-asf-plugin""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: video/x-ms-asf-plugin = "%Program Files%\WINDOW~2\wmplayer.exe"
      To: video/x-ms-asf-plugin = """%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf-plugin
    • From: CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa8f-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf-plugin
    • From: Extension = ".asx"
      To: Extension = "".asx""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-asf-plugin
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Suffixes
    • From: video/x-ms-wm = "asf,asx,wm,wmx"
      To: video/x-ms-wm = ""asf,asx,wm,wmx""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: TYPE28 = "video/x-ms-wm"
      To: TYPE28 = ""video/x-ms-wm""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: video/x-ms-wm = "%Program Files%\WINDOW~2\wmplayer.exe"
      To: video/x-ms-wm = """%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wm
    • From: CLSID = "{cd3afa92-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa92-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wm
    • From: Extension = ".wm"
      To: Extension = "".wm""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wm
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Suffixes
    • From: video/x-ms-wmx = "asf,asx,wm,wmx"
      To: video/x-ms-wmx = ""asf,asx,wm,wmx""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: TYPE30 = "video/x-ms-wmx"
      To: TYPE30 = ""video/x-ms-wmx""
  • In HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
    • From: video/x-ms-wmx = "%Program Files%\WINDOW~2\wmplayer.exe"
      To: video/x-ms-wmx = """%System Root%\PROGRA~1\WINDOW~2\wmplayer.exe"""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmx
    • From: CLSID = "{cd3afa93-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa93-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmx
    • From: Extension = ".wmx"
      To: Extension = "".wmx""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wmx
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ms-wmd
    • From: CLSID = "{ee4da6a4-8c52-4a63-bbb8-97c93d7e1b6c}"
      To: CLSID = ""{ee4da6a4-8c52-4a63-bbb8-97c93d7e1b6c}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ms-wmd
    • From: Extension = ".wmd"
      To: Extension = "".wmd""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-ms-wmd
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ms-wmz
    • From: CLSID = "{cd3afa71-b84f-48f0-9393-7edc34128127}"
      To: CLSID = ""{cd3afa71-b84f-48f0-9393-7edc34128127}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ms-wmz
    • From: Extension = ".wmz"
      To: Extension = "".wmz""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-ms-wmz
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMS
    • From: Source Filter = "{6B6D0800-9ADA-11d0-A520-00A0D10129C0}"
      To: Source Filter = ""{6B6D0800-9ADA-11d0-A520-00A0D10129C0}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mms
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMST
    • From: Source Filter = "{6B6D0800-9ADA-11d0-A520-00A0D10129C0}"
      To: Source Filter = ""{6B6D0800-9ADA-11d0-A520-00A0D10129C0}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mmst
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMSU
    • From: Source Filter = "{6B6D0800-9ADA-11d0-A520-00A0D10129C0}"
      To: Source Filter = ""{6B6D0800-9ADA-11d0-A520-00A0D10129C0}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mmsu
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSBD
    • From: Source Filter = "{6B6D0800-9ADA-11d0-A520-00A0D10129C0}"
      To: Source Filter = ""{6B6D0800-9ADA-11d0-A520-00A0D10129C0}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\msbd
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cda\OpenWithProgIds
    • From: CDAFile = "[REG_NONE, size: 0 bytes]"
      To: CDAFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cdafile
    • From: PreferExecuteOnMismatch = "1"
      To: PreferExecuteOnMismatch = ""1""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cdafile
    • From: EditFlags = "{random values}"
      To: EditFlags = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cdafile\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.cda
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AudioCD\shell\play
    • From: MUIVerb = "@%SystemRoot%\inf\unregmp2.exe,-9991"
      To: MUIVerb = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Devices\AudioCD
    • From: AlreadyRegistered = "yes"
      To: AlreadyRegistered = ""yes""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
    • From: Name = "iexplore.exe"
      To: Name = ""iexplore.exe""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
    • From: ID = "4117b81"
      To: ID = ""41107b81""

手順 6

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %System Root%\Documents and Settings.lnk
  • %Program Files%.lnk
  • %Windows%.lnk
  • %User Profile%\My Documents\My Music.lnk
  • %User Profile%\My Documents\My Pictures.lnk
  • %User Profile%\HTML Help\hh.dat
  • %Program Files%\Windows Media Player\wmplayerc.exe

手順 7

以下のフォルダを検索し削除します。

[ 詳細 ]
フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %System Root%\Autorun.inf
  • %System Root%\RÊCYCLÊR
  • %User Profile%\My Documents\RÊCYCLÊR
  • %User Profile%\Microsoft\HTML Help

手順 8

コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「WORM_KAANEUT.A」と検出したファイルの検索を実行してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 9

以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

  • %System Root%\Autorun.inf

手順 10

以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。

※註：マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。

  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • eLoggerSvc6
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • Norman ZANDA
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • Norman NJeeves
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • NPFSvc32
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • NPROSECSVC
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • NVOY
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • NVCScheduler
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • nvcoas
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • NUAA
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • NPC
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • NOD32krn
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • nod32drv
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • eamon
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • ekrn
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • easdrv
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • EhttpSrv
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • epfwtdir
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MUILanguages
    • FileVersions
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .wma
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • audio/x-ms-wma
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .wma
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • audio/x-ms-wma
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .wax
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • audio/x-ms-wax
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .wax
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • audio/x-ms-wax
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .wmv
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • video/x-ms-wmv
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .wmv
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • video/x-ms-wmv
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .wvx
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • video/x-ms-wvx
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .wvx
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • video/x-ms-wvx
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .asf
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • video/x-ms-asf
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .asf
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • video/x-ms-asf
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .asx
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .asx
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .wpl
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • application/vnd.ms-wpl
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .wpl
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • application/vnd.ms-wpl
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .wm
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • video/x-ms-wm
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .wm
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • video/x-ms-wm
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .wmx
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • video/x-ms-wmx
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .wmx
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • video/x-ms-wmx
  • In HKEY_CLASSES_ROOT\WMDFile\shellex\ContextMenuHandlers
    • WMPPlayAsPlaylist
  • In HKEY_CLASSES_ROOT\WMDFile\shellex\ContextMenuHandlers
    • WMPAddToPlaylist
  • In HKEY_CLASSES_ROOT\WMDFile\shellex\ContextMenuHandlers
    • WMPBurnAudioCD
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .wmd
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • application/x-ms-wmd
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .wmd
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • application/x-ms-wmd
  • In HKEY_CLASSES_ROOT\WMZFile\shellex\ContextMenuHandlers
    • WMPPlayAsPlaylist
  • In HKEY_CLASSES_ROOT\WMZFile\shellex\ContextMenuHandlers
    • WMPAddToPlaylist
  • In HKEY_CLASSES_ROOT\WMZFile\shellex\ContextMenuHandlers
    • WMPBurnAudioCD
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin
    • .wmz
  • In HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME
    • application/x-ms-wmz
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin
    • .wmz
  • In HKEY_CLASSES_ROOT\CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME
    • application/x-ms-wmz
  • In HKEY_CLASSES_ROOT\CDAFile\shellex\ContextMenuHandlers
    • WMPPlayAsPlaylist
  • In HKEY_CLASSES_ROOT\CDAFile\shellex\ContextMenuHandlers
    • WMPAddToPlaylist
  • In HKEY_CLASSES_ROOT\CDAFile\shellex\ContextMenuHandlers
    • WMPBurnAudioCD


ご利用はいかがでしたか？　アンケートにご協力ください