WORM_PROLACO.AC

2012年10月13日

別名:

Worm:Win32/Prolaco.gen!C (Microsoft); IRC/Flood.ff (McAfee); W32.Ackantta@mm (Symantec); Trojan-Dropper.Win32.Typic.bev (Kaspersky); Worm.Win32.Prolaco.gen.c (v) (Sunbelt); Rootkit.36329 (FSecure)

プラットフォーム:

Windows 2000, Windows XP, Windows Server 2003

危険度:

ダメージ度:

感染力:

感染確認数:

マルウェアタイプ: ワーム
破壊活動の有無: なし
暗号化:
感染報告の有無: はい

概要

ワームは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

詳細

ファイルサイズ 439,808 bytes

タイプ EXE

メモリ常駐はい

発見日 2012年7月23日

侵入方法

ワームは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

ワームは、感染したコンピュータ内に以下のように自身のコピーを作成します。

%System%\AdobeARMI.exe
%Program Files%\icq\shared folder\K-Lite Mega Codec v5.5.1.exe
%Program Files%\icq\shared folder\YouTubeGet 5.4.exe
%Program Files%\icq\shared folder\Windows 2008 Enterprise Server VMWare Virtual Machine.exe
%Program Files%\icq\shared folder\K-Lite Mega Codec v5.6.1 Portable.exe
%Program Files%\icq\shared folder\Adobe Photoshop CS4 crack.exe
%Program Files%\icq\shared folder\VmWare 7.0 keygen.exe
%Program Files%\icq\shared folder\WinRAR v3.x keygen RaZoR.exe
%Program Files%\icq\shared folder\Twitter FriendAdder 2.1.1.exe
%Program Files%\icq\shared folder\PDF Unlocker v2.0.3.exe
%Program Files%\icq\shared folder\Image Size Reducer Pro v1.0.1.exe
%Program Files%\icq\shared folder\Anti-Porn v13.5.12.29.exe
%Program Files%\icq\shared folder\Norton Internet Security 2010 crack.exe
%Program Files%\icq\shared folder\Kaspersky AntiVirus 2010 crack.exe
%Program Files%\icq\shared folder\PDF-XChange Pro.exe
%Program Files%\icq\shared folder\Windows 7 Ultimate keygen.exe
%Program Files%\icq\shared folder\RapidShare Killer AIO 2010.exe
%Program Files%\icq\shared folder\Ashampoo Snap 3.02.exe
%Program Files%\icq\shared folder\Blaze DVD Player Pro v6.52.exe
%Program Files%\icq\shared folder\Adobe Illustrator CS4 crack.exe
%Program Files%\icq\shared folder\Rapidshare Auto Downloader 3.8.exe
%Program Files%\icq\shared folder\Trojan Killer v2.9.4173.exe
%Program Files%\icq\shared folder\PDF to Word Converter 3.0.exe
%Program Files%\icq\shared folder\Google SketchUp 7.1 Pro.exe
%Program Files%\icq\shared folder\McAfee Total Protection 2010.exe
%Program Files%\icq\shared folder\Mp3 Splitter and Joiner Pro v3.48.exe
%Program Files%\icq\shared folder\Youtube Music Downloader 1.0.exe
%Program Files%\icq\shared folder\Adobe Acrobat Reader keygen.exe
%Program Files%\icq\shared folder\VmWare keygen.exe
%Program Files%\icq\shared folder\AnyDVD HD v.6.3.1.8 Beta incl crack.exe
%Program Files%\icq\shared folder\Ad-aware 2010.exe
%Program Files%\icq\shared folder\BitDefender AntiVirus 2010 Keygen.exe
%Program Files%\icq\shared folder\Norton Anti-Virus 2010 Enterprise Crack.exe
%Program Files%\icq\shared folder\Total Commander7 license+keygen.exe
%Program Files%\icq\shared folder\LimeWire Pro v4.18.3.exe
%Program Files%\icq\shared folder\Download Accelerator Plus v9.exe
%Program Files%\icq\shared folder\Internet Download Manager V5.exe
%Program Files%\icq\shared folder\Myspace theme collection.exe
%Program Files%\icq\shared folder\Nero 9 9.2.6.0 keygen.exe
%Program Files%\icq\shared folder\Motorola, nokia, ericsson mobil phone tools.exe
%Program Files%\icq\shared folder\Absolute Video Converter 6.2.exe
%Program Files%\icq\shared folder\Daemon Tools Pro 4.11.exe
%Program Files%\icq\shared folder\Download Boost 2.0.exe
%Program Files%\icq\shared folder\Avast 4.8 Professional.exe
%Program Files%\icq\shared folder\Grand Theft Auto IV (Offline Activation).exe
%Program Files%\icq\shared folder\Alcohol 120 v1.9.7.exe
%Program Files%\icq\shared folder\CleanMyPC Registry Cleaner v6.02.exe
%Program Files%\icq\shared folder\Super Utilities Pro 2009 11.0.exe
%Program Files%\icq\shared folder\Power ISO v4.2 + keygen axxo.exe
%Program Files%\icq\shared folder\G-Force Platinum v3.7.5.exe
%Program Files%\icq\shared folder\Divx Pro 7 + keymaker.exe
%Program Files%\icq\shared folder\Magic Video Converter 8 0 2 18.exe
%Program Files%\icq\shared folder\Sophos antivirus updater bypass.exe
%Program Files%\icq\shared folder\DVD Tools Nero 10.5.6.0.exe
%Program Files%\icq\shared folder\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
%Program Files%\icq\shared folder\PDF password remover (works with all acrobat reader).exe
%Program Files%\icq\shared folder\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe
%Program Files%\icq\shared folder\Windows2008 keygen and activator.exe
%Program Files%\icq\shared folder\Tuneup Ultilities 2010.exe
%Program Files%\icq\shared folder\Kaspersky Internet Security 2010 keygen.exe
%Program Files%\icq\shared folder\Windows XP PRO Corp SP3 valid-key generator.exe
%Program Files%\icq\shared folder\Starcraft2 Patch v0.2.exe
%Program Files%\icq\shared folder\Starcraft2 keys.txt.exe
%Program Files%\icq\shared folder\Starcraft2 Crack.exe
%Program Files%\icq\shared folder\Starcraft2 Oblivion DLL.exe
%Program Files%\icq\shared folder\Starcraft2.exe
%Program Files%\grokster\my grokster\K-Lite Mega Codec v5.5.1.exe
%Program Files%\grokster\my grokster\YouTubeGet 5.4.exe
%Program Files%\grokster\my grokster\Windows 2008 Enterprise Server VMWare Virtual Machine.exe
%Program Files%\grokster\my grokster\K-Lite Mega Codec v5.6.1 Portable.exe
%Program Files%\grokster\my grokster\Adobe Photoshop CS4 crack.exe
%Program Files%\grokster\my grokster\VmWare 7.0 keygen.exe
%Program Files%\grokster\my grokster\WinRAR v3.x keygen RaZoR.exe
%Program Files%\grokster\my grokster\Twitter FriendAdder 2.1.1.exe
%Program Files%\grokster\my grokster\PDF Unlocker v2.0.3.exe
%Program Files%\grokster\my grokster\Image Size Reducer Pro v1.0.1.exe
%Program Files%\grokster\my grokster\Anti-Porn v13.5.12.29.exe
%Program Files%\grokster\my grokster\Norton Internet Security 2010 crack.exe
%Program Files%\grokster\my grokster\Kaspersky AntiVirus 2010 crack.exe
%Program Files%\grokster\my grokster\PDF-XChange Pro.exe
%Program Files%\grokster\my grokster\Windows 7 Ultimate keygen.exe
%Program Files%\grokster\my grokster\RapidShare Killer AIO 2010.exe
%Program Files%\grokster\my grokster\Ashampoo Snap 3.02.exe
%Program Files%\grokster\my grokster\Blaze DVD Player Pro v6.52.exe
%Program Files%\grokster\my grokster\Adobe Illustrator CS4 crack.exe
%Program Files%\grokster\my grokster\Rapidshare Auto Downloader 3.8.exe
%Program Files%\grokster\my grokster\Trojan Killer v2.9.4173.exe
%Program Files%\grokster\my grokster\PDF to Word Converter 3.0.exe
%Program Files%\grokster\my grokster\Google SketchUp 7.1 Pro.exe
%Program Files%\grokster\my grokster\McAfee Total Protection 2010.exe
%Program Files%\grokster\my grokster\Mp3 Splitter and Joiner Pro v3.48.exe
%Program Files%\grokster\my grokster\Youtube Music Downloader 1.0.exe
%Program Files%\grokster\my grokster\Adobe Acrobat Reader keygen.exe
%Program Files%\grokster\my grokster\VmWare keygen.exe
%Program Files%\grokster\my grokster\AnyDVD HD v.6.3.1.8 Beta incl crack.exe
%Program Files%\grokster\my grokster\Ad-aware 2010.exe
%Program Files%\grokster\my grokster\BitDefender AntiVirus 2010 Keygen.exe
%Program Files%\grokster\my grokster\Norton Anti-Virus 2010 Enterprise Crack.exe
%Program Files%\grokster\my grokster\Total Commander7 license+keygen.exe
%Program Files%\grokster\my grokster\LimeWire Pro v4.18.3.exe
%Program Files%\grokster\my grokster\Download Accelerator Plus v9.exe
%Program Files%\grokster\my grokster\Internet Download Manager V5.exe
%Program Files%\grokster\my grokster\Myspace theme collection.exe
%Program Files%\grokster\my grokster\Nero 9 9.2.6.0 keygen.exe
%Program Files%\grokster\my grokster\Motorola, nokia, ericsson mobil phone tools.exe
%Program Files%\grokster\my grokster\Absolute Video Converter 6.2.exe
%Program Files%\grokster\my grokster\Daemon Tools Pro 4.11.exe
%Program Files%\grokster\my grokster\Download Boost 2.0.exe
%Program Files%\grokster\my grokster\Avast 4.8 Professional.exe
%Program Files%\grokster\my grokster\Grand Theft Auto IV (Offline Activation).exe
%Program Files%\grokster\my grokster\Alcohol 120 v1.9.7.exe
%Program Files%\grokster\my grokster\CleanMyPC Registry Cleaner v6.02.exe
%Program Files%\grokster\my grokster\Super Utilities Pro 2009 11.0.exe
%Program Files%\grokster\my grokster\Power ISO v4.2 + keygen axxo.exe
%Program Files%\grokster\my grokster\G-Force Platinum v3.7.5.exe
%Program Files%\grokster\my grokster\Divx Pro 7 + keymaker.exe
%Program Files%\grokster\my grokster\Magic Video Converter 8 0 2 18.exe
%Program Files%\grokster\my grokster\Sophos antivirus updater bypass.exe
%Program Files%\grokster\my grokster\DVD Tools Nero 10.5.6.0.exe
%Program Files%\grokster\my grokster\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
%Program Files%\grokster\my grokster\PDF password remover (works with all acrobat reader).exe
%Program Files%\grokster\my grokster\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe
%Program Files%\grokster\my grokster\Windows2008 keygen and activator.exe
%Program Files%\grokster\my grokster\Tuneup Ultilities 2010.exe
%Program Files%\grokster\my grokster\Kaspersky Internet Security 2010 keygen.exe
%Program Files%\grokster\my grokster\Windows XP PRO Corp SP3 valid-key generator.exe
%Program Files%\grokster\my grokster\Starcraft2 Patch v0.2.exe
%Program Files%\grokster\my grokster\Starcraft2 keys.txt.exe
%Program Files%\grokster\my grokster\Starcraft2 Crack.exe
%Program Files%\grokster\my grokster\Starcraft2 Oblivion DLL.exe
%Program Files%\grokster\my grokster\Starcraft2.exe
%Program Files%\emule\incoming\K-Lite Mega Codec v5.5.1.exe
%Program Files%\emule\incoming\YouTubeGet 5.4.exe
%Program Files%\emule\incoming\Windows 2008 Enterprise Server VMWare Virtual Machine.exe
%Program Files%\emule\incoming\K-Lite Mega Codec v5.6.1 Portable.exe
%Program Files%\emule\incoming\Adobe Photoshop CS4 crack.exe
%Program Files%\emule\incoming\VmWare 7.0 keygen.exe
%Program Files%\emule\incoming\WinRAR v3.x keygen RaZoR.exe
%Program Files%\emule\incoming\Twitter FriendAdder 2.1.1.exe
%Program Files%\emule\incoming\PDF Unlocker v2.0.3.exe
%Program Files%\emule\incoming\Image Size Reducer Pro v1.0.1.exe
%Program Files%\emule\incoming\Anti-Porn v13.5.12.29.exe
%Program Files%\emule\incoming\Norton Internet Security 2010 crack.exe
%Program Files%\emule\incoming\Kaspersky AntiVirus 2010 crack.exe
%Program Files%\emule\incoming\PDF-XChange Pro.exe
%Program Files%\emule\incoming\Windows 7 Ultimate keygen.exe
%Program Files%\emule\incoming\RapidShare Killer AIO 2010.exe
%Program Files%\emule\incoming\Ashampoo Snap 3.02.exe
%Program Files%\emule\incoming\Blaze DVD Player Pro v6.52.exe
%Program Files%\emule\incoming\Adobe Illustrator CS4 crack.exe
%Program Files%\emule\incoming\Rapidshare Auto Downloader 3.8.exe
%Program Files%\emule\incoming\Trojan Killer v2.9.4173.exe
%Program Files%\emule\incoming\PDF to Word Converter 3.0.exe
%Program Files%\emule\incoming\Google SketchUp 7.1 Pro.exe
%Program Files%\emule\incoming\McAfee Total Protection 2010.exe
%Program Files%\emule\incoming\Mp3 Splitter and Joiner Pro v3.48.exe
%Program Files%\emule\incoming\Youtube Music Downloader 1.0.exe
%Program Files%\emule\incoming\Adobe Acrobat Reader keygen.exe
%Program Files%\emule\incoming\VmWare keygen.exe
%Program Files%\emule\incoming\AnyDVD HD v.6.3.1.8 Beta incl crack.exe
%Program Files%\emule\incoming\Ad-aware 2010.exe
%Program Files%\emule\incoming\BitDefender AntiVirus 2010 Keygen.exe
%Program Files%\emule\incoming\Norton Anti-Virus 2010 Enterprise Crack.exe
%Program Files%\emule\incoming\Total Commander7 license+keygen.exe
%Program Files%\emule\incoming\LimeWire Pro v4.18.3.exe
%Program Files%\emule\incoming\Download Accelerator Plus v9.exe
%Program Files%\emule\incoming\Internet Download Manager V5.exe
%Program Files%\emule\incoming\Myspace theme collection.exe
%Program Files%\emule\incoming\Nero 9 9.2.6.0 keygen.exe
%Program Files%\emule\incoming\Motorola, nokia, ericsson mobil phone tools.exe
%Program Files%\emule\incoming\Absolute Video Converter 6.2.exe
%Program Files%\emule\incoming\Daemon Tools Pro 4.11.exe
%Program Files%\emule\incoming\Download Boost 2.0.exe
%Program Files%\emule\incoming\Avast 4.8 Professional.exe
%Program Files%\emule\incoming\Grand Theft Auto IV (Offline Activation).exe
%Program Files%\emule\incoming\Alcohol 120 v1.9.7.exe
%Program Files%\emule\incoming\CleanMyPC Registry Cleaner v6.02.exe
%Program Files%\emule\incoming\Super Utilities Pro 2009 11.0.exe
%Program Files%\emule\incoming\Power ISO v4.2 + keygen axxo.exe
%Program Files%\emule\incoming\G-Force Platinum v3.7.5.exe
%Program Files%\emule\incoming\Divx Pro 7 + keymaker.exe
%Program Files%\emule\incoming\Magic Video Converter 8 0 2 18.exe
%Program Files%\emule\incoming\Sophos antivirus updater bypass.exe
%Program Files%\emule\incoming\DVD Tools Nero 10.5.6.0.exe
%Program Files%\emule\incoming\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
%Program Files%\emule\incoming\PDF password remover (works with all acrobat reader).exe
%Program Files%\emule\incoming\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe
%Program Files%\emule\incoming\Windows2008 keygen and activator.exe
%Program Files%\emule\incoming\Tuneup Ultilities 2010.exe
%Program Files%\emule\incoming\Kaspersky Internet Security 2010 keygen.exe
%Program Files%\emule\incoming\Windows XP PRO Corp SP3 valid-key generator.exe
%Program Files%\emule\incoming\Starcraft2 Patch v0.2.exe
%Program Files%\emule\incoming\Starcraft2 keys.txt.exe
%Program Files%\emule\incoming\Starcraft2 Crack.exe
%Program Files%\emule\incoming\Starcraft2 Oblivion DLL.exe
%Program Files%\emule\incoming\Starcraft2.exe
%Program Files%\morpheus\my shared folder\K-Lite Mega Codec v5.5.1.exe
%Program Files%\morpheus\my shared folder\YouTubeGet 5.4.exe
%Program Files%\morpheus\my shared folder\Windows 2008 Enterprise Server VMWare Virtual Machine.exe
%Program Files%\morpheus\my shared folder\K-Lite Mega Codec v5.6.1 Portable.exe
%Program Files%\morpheus\my shared folder\Adobe Photoshop CS4 crack.exe
%Program Files%\morpheus\my shared folder\VmWare 7.0 keygen.exe
%Program Files%\morpheus\my shared folder\WinRAR v3.x keygen RaZoR.exe
%Program Files%\morpheus\my shared folder\Twitter FriendAdder 2.1.1.exe
%Program Files%\morpheus\my shared folder\PDF Unlocker v2.0.3.exe
%Program Files%\morpheus\my shared folder\Image Size Reducer Pro v1.0.1.exe
%Program Files%\morpheus\my shared folder\Anti-Porn v13.5.12.29.exe
%Program Files%\morpheus\my shared folder\Norton Internet Security 2010 crack.exe
%Program Files%\morpheus\my shared folder\Kaspersky AntiVirus 2010 crack.exe
%Program Files%\morpheus\my shared folder\PDF-XChange Pro.exe
%Program Files%\morpheus\my shared folder\Windows 7 Ultimate keygen.exe
%Program Files%\morpheus\my shared folder\RapidShare Killer AIO 2010.exe
%Program Files%\morpheus\my shared folder\Ashampoo Snap 3.02.exe
%Program Files%\morpheus\my shared folder\Blaze DVD Player Pro v6.52.exe
%Program Files%\morpheus\my shared folder\Adobe Illustrator CS4 crack.exe
%Program Files%\morpheus\my shared folder\Rapidshare Auto Downloader 3.8.exe
%Program Files%\morpheus\my shared folder\Trojan Killer v2.9.4173.exe
%Program Files%\morpheus\my shared folder\PDF to Word Converter 3.0.exe
%Program Files%\morpheus\my shared folder\Google SketchUp 7.1 Pro.exe
%Program Files%\morpheus\my shared folder\McAfee Total Protection 2010.exe
%Program Files%\morpheus\my shared folder\Mp3 Splitter and Joiner Pro v3.48.exe
%Program Files%\morpheus\my shared folder\Youtube Music Downloader 1.0.exe
%Program Files%\morpheus\my shared folder\Adobe Acrobat Reader keygen.exe
%Program Files%\morpheus\my shared folder\VmWare keygen.exe
%Program Files%\morpheus\my shared folder\AnyDVD HD v.6.3.1.8 Beta incl crack.exe
%Program Files%\morpheus\my shared folder\Ad-aware 2010.exe
%Program Files%\morpheus\my shared folder\BitDefender AntiVirus 2010 Keygen.exe
%Program Files%\morpheus\my shared folder\Norton Anti-Virus 2010 Enterprise Crack.exe
%Program Files%\morpheus\my shared folder\Total Commander7 license+keygen.exe
%Program Files%\morpheus\my shared folder\LimeWire Pro v4.18.3.exe
%Program Files%\morpheus\my shared folder\Download Accelerator Plus v9.exe
%Program Files%\morpheus\my shared folder\Internet Download Manager V5.exe
%Program Files%\morpheus\my shared folder\Myspace theme collection.exe
%Program Files%\morpheus\my shared folder\Nero 9 9.2.6.0 keygen.exe
%Program Files%\morpheus\my shared folder\Motorola, nokia, ericsson mobil phone tools.exe
%Program Files%\morpheus\my shared folder\Absolute Video Converter 6.2.exe
%Program Files%\morpheus\my shared folder\Daemon Tools Pro 4.11.exe
%Program Files%\morpheus\my shared folder\Download Boost 2.0.exe
%Program Files%\morpheus\my shared folder\Avast 4.8 Professional.exe
%Program Files%\morpheus\my shared folder\Grand Theft Auto IV (Offline Activation).exe
%Program Files%\morpheus\my shared folder\Alcohol 120 v1.9.7.exe
%Program Files%\morpheus\my shared folder\CleanMyPC Registry Cleaner v6.02.exe
%Program Files%\morpheus\my shared folder\Super Utilities Pro 2009 11.0.exe
%Program Files%\morpheus\my shared folder\Power ISO v4.2 + keygen axxo.exe
%Program Files%\morpheus\my shared folder\G-Force Platinum v3.7.5.exe
%Program Files%\morpheus\my shared folder\Divx Pro 7 + keymaker.exe
%Program Files%\morpheus\my shared folder\Magic Video Converter 8 0 2 18.exe
%Program Files%\morpheus\my shared folder\Sophos antivirus updater bypass.exe
%Program Files%\morpheus\my shared folder\DVD Tools Nero 10.5.6.0.exe
%Program Files%\morpheus\my shared folder\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
%Program Files%\morpheus\my shared folder\PDF password remover (works with all acrobat reader).exe
%Program Files%\morpheus\my shared folder\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe
%Program Files%\morpheus\my shared folder\Windows2008 keygen and activator.exe
%Program Files%\morpheus\my shared folder\Tuneup Ultilities 2010.exe
%Program Files%\morpheus\my shared folder\Kaspersky Internet Security 2010 keygen.exe
%Program Files%\morpheus\my shared folder\Windows XP PRO Corp SP3 valid-key generator.exe
%Program Files%\morpheus\my shared folder\Starcraft2 Patch v0.2.exe
%Program Files%\morpheus\my shared folder\Starcraft2 keys.txt.exe
%Program Files%\morpheus\my shared folder\Starcraft2 Crack.exe
%Program Files%\morpheus\my shared folder\Starcraft2 Oblivion DLL.exe
%Program Files%\morpheus\my shared folder\Starcraft2.exe
%Program Files%\limewire\shared\K-Lite Mega Codec v5.5.1.exe
%Program Files%\limewire\shared\YouTubeGet 5.4.exe
%Program Files%\limewire\shared\Windows 2008 Enterprise Server VMWare Virtual Machine.exe
%Program Files%\limewire\shared\K-Lite Mega Codec v5.6.1 Portable.exe
%Program Files%\limewire\shared\Adobe Photoshop CS4 crack.exe
%Program Files%\limewire\shared\VmWare 7.0 keygen.exe
%Program Files%\limewire\shared\WinRAR v3.x keygen RaZoR.exe
%Program Files%\limewire\shared\Twitter FriendAdder 2.1.1.exe
%Program Files%\limewire\shared\PDF Unlocker v2.0.3.exe
%Program Files%\limewire\shared\Image Size Reducer Pro v1.0.1.exe
%Program Files%\limewire\shared\Anti-Porn v13.5.12.29.exe
%Program Files%\limewire\shared\Norton Internet Security 2010 crack.exe
%Program Files%\limewire\shared\Kaspersky AntiVirus 2010 crack.exe
%Program Files%\limewire\shared\PDF-XChange Pro.exe
%Program Files%\limewire\shared\Windows 7 Ultimate keygen.exe
%Program Files%\limewire\shared\RapidShare Killer AIO 2010.exe
%Program Files%\limewire\shared\Ashampoo Snap 3.02.exe
%Program Files%\limewire\shared\Blaze DVD Player Pro v6.52.exe
%Program Files%\limewire\shared\Adobe Illustrator CS4 crack.exe
%Program Files%\limewire\shared\Rapidshare Auto Downloader 3.8.exe
%Program Files%\limewire\shared\Trojan Killer v2.9.4173.exe
%Program Files%\limewire\shared\PDF to Word Converter 3.0.exe
%Program Files%\limewire\shared\Google SketchUp 7.1 Pro.exe
%Program Files%\limewire\shared\McAfee Total Protection 2010.exe
%Program Files%\limewire\shared\Mp3 Splitter and Joiner Pro v3.48.exe
%Program Files%\limewire\shared\Youtube Music Downloader 1.0.exe
%Program Files%\limewire\shared\Adobe Acrobat Reader keygen.exe
%Program Files%\limewire\shared\VmWare keygen.exe
%Program Files%\limewire\shared\AnyDVD HD v.6.3.1.8 Beta incl crack.exe
%Program Files%\limewire\shared\Ad-aware 2010.exe
%Program Files%\limewire\shared\BitDefender AntiVirus 2010 Keygen.exe
%Program Files%\limewire\shared\Norton Anti-Virus 2010 Enterprise Crack.exe
%Program Files%\limewire\shared\Total Commander7 license+keygen.exe
%Program Files%\limewire\shared\LimeWire Pro v4.18.3.exe
%Program Files%\limewire\shared\Download Accelerator Plus v9.exe
%Program Files%\limewire\shared\Internet Download Manager V5.exe
%Program Files%\limewire\shared\Myspace theme collection.exe
%Program Files%\limewire\shared\Nero 9 9.2.6.0 keygen.exe
%Program Files%\limewire\shared\Motorola, nokia, ericsson mobil phone tools.exe
%Program Files%\limewire\shared\Absolute Video Converter 6.2.exe
%Program Files%\limewire\shared\Daemon Tools Pro 4.11.exe
%Program Files%\limewire\shared\Download Boost 2.0.exe
%Program Files%\limewire\shared\Avast 4.8 Professional.exe
%Program Files%\limewire\shared\Grand Theft Auto IV (Offline Activation).exe
%Program Files%\limewire\shared\Alcohol 120 v1.9.7.exe
%Program Files%\limewire\shared\CleanMyPC Registry Cleaner v6.02.exe
%Program Files%\limewire\shared\Super Utilities Pro 2009 11.0.exe
%Program Files%\limewire\shared\Power ISO v4.2 + keygen axxo.exe
%Program Files%\limewire\shared\G-Force Platinum v3.7.5.exe
%Program Files%\limewire\shared\Divx Pro 7 + keymaker.exe
%Program Files%\limewire\shared\Magic Video Converter 8 0 2 18.exe
%Program Files%\limewire\shared\Sophos antivirus updater bypass.exe
%Program Files%\limewire\shared\DVD Tools Nero 10.5.6.0.exe
%Program Files%\limewire\shared\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
%Program Files%\limewire\shared\PDF password remover (works with all acrobat reader).exe
%Program Files%\limewire\shared\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe
%Program Files%\limewire\shared\Windows2008 keygen and activator.exe
%Program Files%\limewire\shared\Tuneup Ultilities 2010.exe
%Program Files%\limewire\shared\Kaspersky Internet Security 2010 keygen.exe
%Program Files%\limewire\shared\Windows XP PRO Corp SP3 valid-key generator.exe
%Program Files%\limewire\shared\Starcraft2 Patch v0.2.exe
%Program Files%\limewire\shared\Starcraft2 keys.txt.exe
%Program Files%\limewire\shared\Starcraft2 Crack.exe
%Program Files%\limewire\shared\Starcraft2 Oblivion DLL.exe
%Program Files%\limewire\shared\Starcraft2.exe
%Program Files%\tesla\files\K-Lite Mega Codec v5.5.1.exe
%Program Files%\tesla\files\YouTubeGet 5.4.exe
%Program Files%\tesla\files\Windows 2008 Enterprise Server VMWare Virtual Machine.exe
%Program Files%\tesla\files\K-Lite Mega Codec v5.6.1 Portable.exe
%Program Files%\tesla\files\Adobe Photoshop CS4 crack.exe
%Program Files%\tesla\files\VmWare 7.0 keygen.exe
%Program Files%\tesla\files\WinRAR v3.x keygen RaZoR.exe
%Program Files%\tesla\files\Twitter FriendAdder 2.1.1.exe
%Program Files%\tesla\files\PDF Unlocker v2.0.3.exe
%Program Files%\tesla\files\Image Size Reducer Pro v1.0.1.exe
%Program Files%\tesla\files\Anti-Porn v13.5.12.29.exe
%Program Files%\tesla\files\Norton Internet Security 2010 crack.exe
%Program Files%\tesla\files\Kaspersky AntiVirus 2010 crack.exe
%Program Files%\tesla\files\PDF-XChange Pro.exe
%Program Files%\tesla\files\Windows 7 Ultimate keygen.exe
%Program Files%\tesla\files\RapidShare Killer AIO 2010.exe
%Program Files%\tesla\files\Ashampoo Snap 3.02.exe
%Program Files%\tesla\files\Blaze DVD Player Pro v6.52.exe
%Program Files%\tesla\files\Adobe Illustrator CS4 crack.exe
%Program Files%\tesla\files\Rapidshare Auto Downloader 3.8.exe
%Program Files%\tesla\files\Trojan Killer v2.9.4173.exe
%Program Files%\tesla\files\PDF to Word Converter 3.0.exe
%Program Files%\tesla\files\Google SketchUp 7.1 Pro.exe
%Program Files%\tesla\files\McAfee Total Protection 2010.exe
%Program Files%\tesla\files\Mp3 Splitter and Joiner Pro v3.48.exe
%Program Files%\tesla\files\Youtube Music Downloader 1.0.exe
%Program Files%\tesla\files\Adobe Acrobat Reader keygen.exe
%Program Files%\tesla\files\VmWare keygen.exe
%Program Files%\tesla\files\AnyDVD HD v.6.3.1.8 Beta incl crack.exe
%Program Files%\tesla\files\Ad-aware 2010.exe
%Program Files%\tesla\files\BitDefender AntiVirus 2010 Keygen.exe
%Program Files%\tesla\files\Norton Anti-Virus 2010 Enterprise Crack.exe
%Program Files%\tesla\files\Total Commander7 license+keygen.exe
%Program Files%\tesla\files\LimeWire Pro v4.18.3.exe
%Program Files%\tesla\files\Download Accelerator Plus v9.exe
%Program Files%\tesla\files\Internet Download Manager V5.exe
%Program Files%\tesla\files\Myspace theme collection.exe
%Program Files%\tesla\files\Nero 9 9.2.6.0 keygen.exe
%Program Files%\tesla\files\Motorola, nokia, ericsson mobil phone tools.exe
%Program Files%\tesla\files\Absolute Video Converter 6.2.exe
%Program Files%\tesla\files\Daemon Tools Pro 4.11.exe
%Program Files%\tesla\files\Download Boost 2.0.exe
%Program Files%\tesla\files\Avast 4.8 Professional.exe
%Program Files%\tesla\files\Grand Theft Auto IV (Offline Activation).exe
%Program Files%\tesla\files\Alcohol 120 v1.9.7.exe
%Program Files%\tesla\files\CleanMyPC Registry Cleaner v6.02.exe
%Program Files%\tesla\files\Super Utilities Pro 2009 11.0.exe
%Program Files%\tesla\files\Power ISO v4.2 + keygen axxo.exe
%Program Files%\tesla\files\G-Force Platinum v3.7.5.exe
%Program Files%\tesla\files\Divx Pro 7 + keymaker.exe
%Program Files%\tesla\files\Magic Video Converter 8 0 2 18.exe
%Program Files%\tesla\files\Sophos antivirus updater bypass.exe
%Program Files%\tesla\files\DVD Tools Nero 10.5.6.0.exe
%Program Files%\tesla\files\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
%Program Files%\tesla\files\PDF password remover (works with all acrobat reader).exe
%Program Files%\tesla\files\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe
%Program Files%\tesla\files\Windows2008 keygen and activator.exe
%Program Files%\tesla\files\Tuneup Ultilities 2010.exe
%Program Files%\tesla\files\Kaspersky Internet Security 2010 keygen.exe
%Program Files%\tesla\files\Windows XP PRO Corp SP3 valid-key generator.exe
%Program Files%\tesla\files\Starcraft2 Patch v0.2.exe
%Program Files%\tesla\files\Starcraft2 keys.txt.exe
%Program Files%\tesla\files\Starcraft2 Crack.exe
%Program Files%\tesla\files\Starcraft2 Oblivion DLL.exe
%Program Files%\tesla\files\Starcraft2.exe
%Program Files%\winmx\shared\K-Lite Mega Codec v5.5.1.exe
%Program Files%\winmx\shared\YouTubeGet 5.4.exe
%Program Files%\winmx\shared\Windows 2008 Enterprise Server VMWare Virtual Machine.exe
%Program Files%\winmx\shared\K-Lite Mega Codec v5.6.1 Portable.exe
%Program Files%\winmx\shared\Adobe Photoshop CS4 crack.exe
%Program Files%\winmx\shared\VmWare 7.0 keygen.exe
%Program Files%\winmx\shared\WinRAR v3.x keygen RaZoR.exe
%Program Files%\winmx\shared\Twitter FriendAdder 2.1.1.exe
%Program Files%\winmx\shared\PDF Unlocker v2.0.3.exe
%Program Files%\winmx\shared\Image Size Reducer Pro v1.0.1.exe
%Program Files%\winmx\shared\Anti-Porn v13.5.12.29.exe
%Program Files%\winmx\shared\Norton Internet Security 2010 crack.exe
%Program Files%\winmx\shared\Kaspersky AntiVirus 2010 crack.exe
%Program Files%\winmx\shared\PDF-XChange Pro.exe
%Program Files%\winmx\shared\Windows 7 Ultimate keygen.exe
%Program Files%\winmx\shared\RapidShare Killer AIO 2010.exe
%Program Files%\winmx\shared\Ashampoo Snap 3.02.exe
%Program Files%\winmx\shared\Blaze DVD Player Pro v6.52.exe
%Program Files%\winmx\shared\Adobe Illustrator CS4 crack.exe
%Program Files%\winmx\shared\Rapidshare Auto Downloader 3.8.exe
%Program Files%\winmx\shared\Trojan Killer v2.9.4173.exe
%Program Files%\winmx\shared\PDF to Word Converter 3.0.exe
%Program Files%\winmx\shared\Google SketchUp 7.1 Pro.exe
%Program Files%\winmx\shared\McAfee Total Protection 2010.exe
%Program Files%\winmx\shared\Mp3 Splitter and Joiner Pro v3.48.exe
%Program Files%\winmx\shared\Youtube Music Downloader 1.0.exe
%Program Files%\winmx\shared\Adobe Acrobat Reader keygen.exe
%Program Files%\winmx\shared\VmWare keygen.exe
%Program Files%\winmx\shared\AnyDVD HD v.6.3.1.8 Beta incl crack.exe
%Program Files%\winmx\shared\Ad-aware 2010.exe
%Program Files%\winmx\shared\BitDefender AntiVirus 2010 Keygen.exe
%Program Files%\winmx\shared\Norton Anti-Virus 2010 Enterprise Crack.exe
%Program Files%\winmx\shared\Total Commander7 license+keygen.exe
%Program Files%\winmx\shared\LimeWire Pro v4.18.3.exe
%Program Files%\winmx\shared\Download Accelerator Plus v9.exe
%Program Files%\winmx\shared\Internet Download Manager V5.exe
%Program Files%\winmx\shared\Myspace theme collection.exe
%Program Files%\winmx\shared\Nero 9 9.2.6.0 keygen.exe
%Program Files%\winmx\shared\Motorola, nokia, ericsson mobil phone tools.exe
%Program Files%\winmx\shared\Absolute Video Converter 6.2.exe
%Program Files%\winmx\shared\Daemon Tools Pro 4.11.exe
%Program Files%\winmx\shared\Download Boost 2.0.exe
%Program Files%\winmx\shared\Avast 4.8 Professional.exe
%Program Files%\winmx\shared\Grand Theft Auto IV (Offline Activation).exe
%Program Files%\winmx\shared\Alcohol 120 v1.9.7.exe
%Program Files%\winmx\shared\CleanMyPC Registry Cleaner v6.02.exe
%Program Files%\winmx\shared\Super Utilities Pro 2009 11.0.exe
%Program Files%\winmx\shared\Power ISO v4.2 + keygen axxo.exe
%Program Files%\winmx\shared\G-Force Platinum v3.7.5.exe
%Program Files%\winmx\shared\Divx Pro 7 + keymaker.exe
%Program Files%\winmx\shared\Magic Video Converter 8 0 2 18.exe
%Program Files%\winmx\shared\Sophos antivirus updater bypass.exe
%Program Files%\winmx\shared\DVD Tools Nero 10.5.6.0.exe
%Program Files%\winmx\shared\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
%Program Files%\winmx\shared\PDF password remover (works with all acrobat reader).exe
%Program Files%\winmx\shared\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe
%Program Files%\winmx\shared\Windows2008 keygen and activator.exe
%Program Files%\winmx\shared\Tuneup Ultilities 2010.exe
%Program Files%\winmx\shared\Kaspersky Internet Security 2010 keygen.exe
%Program Files%\winmx\shared\Windows XP PRO Corp SP3 valid-key generator.exe
%Program Files%\winmx\shared\Starcraft2 Patch v0.2.exe
%Program Files%\winmx\shared\Starcraft2 keys.txt.exe
%Program Files%\winmx\shared\Starcraft2 Crack.exe
%Program Files%\winmx\shared\Starcraft2 Oblivion DLL.exe
%Program Files%\winmx\shared\Starcraft2.exe
%System Root%\Downloads\K-Lite Mega Codec v5.5.1.exe
%System Root%\Downloads\YouTubeGet 5.4.exe
%System Root%\Downloads\Windows 2008 Enterprise Server VMWare Virtual Machine.exe
%System Root%\Downloads\K-Lite Mega Codec v5.6.1 Portable.exe
%System Root%\Downloads\Adobe Photoshop CS4 crack.exe
%System Root%\Downloads\VmWare 7.0 keygen.exe
%System Root%\Downloads\WinRAR v3.x keygen RaZoR.exe
%System Root%\Downloads\Twitter FriendAdder 2.1.1.exe
%System Root%\Downloads\PDF Unlocker v2.0.3.exe
%System Root%\Downloads\Image Size Reducer Pro v1.0.1.exe
%System Root%\Downloads\Anti-Porn v13.5.12.29.exe
%System Root%\Downloads\Norton Internet Security 2010 crack.exe
%System Root%\Downloads\Kaspersky AntiVirus 2010 crack.exe
%System Root%\Downloads\PDF-XChange Pro.exe
%System Root%\Downloads\Windows 7 Ultimate keygen.exe
%System Root%\Downloads\RapidShare Killer AIO 2010.exe
%System Root%\Downloads\Ashampoo Snap 3.02.exe
%System Root%\Downloads\Blaze DVD Player Pro v6.52.exe
%System Root%\Downloads\Adobe Illustrator CS4 crack.exe
%System Root%\Downloads\Rapidshare Auto Downloader 3.8.exe
%System Root%\Downloads\Trojan Killer v2.9.4173.exe
%System Root%\Downloads\PDF to Word Converter 3.0.exe
%System Root%\Downloads\Google SketchUp 7.1 Pro.exe
%System Root%\Downloads\McAfee Total Protection 2010.exe
%System Root%\Downloads\Mp3 Splitter and Joiner Pro v3.48.exe
%System Root%\Downloads\Youtube Music Downloader 1.0.exe
%System Root%\Downloads\Adobe Acrobat Reader keygen.exe
%System Root%\Downloads\VmWare keygen.exe
%System Root%\Downloads\AnyDVD HD v.6.3.1.8 Beta incl crack.exe
%System Root%\Downloads\Ad-aware 2010.exe
%System Root%\Downloads\BitDefender AntiVirus 2010 Keygen.exe
%System Root%\Downloads\Norton Anti-Virus 2010 Enterprise Crack.exe
%System Root%\Downloads\Total Commander7 license+keygen.exe
%System Root%\Downloads\LimeWire Pro v4.18.3.exe
%System Root%\Downloads\Download Accelerator Plus v9.exe
%System Root%\Downloads\Internet Download Manager V5.exe
%System Root%\Downloads\Myspace theme collection.exe
%System Root%\Downloads\Nero 9 9.2.6.0 keygen.exe
%System Root%\Downloads\Motorola, nokia, ericsson mobil phone tools.exe
%System Root%\Downloads\Absolute Video Converter 6.2.exe
%System Root%\Downloads\Daemon Tools Pro 4.11.exe
%System Root%\Downloads\Download Boost 2.0.exe
%System Root%\Downloads\Avast 4.8 Professional.exe
%System Root%\Downloads\Grand Theft Auto IV (Offline Activation).exe
%System Root%\Downloads\Alcohol 120 v1.9.7.exe
%System Root%\Downloads\CleanMyPC Registry Cleaner v6.02.exe
%System Root%\Downloads\Super Utilities Pro 2009 11.0.exe
%System Root%\Downloads\Power ISO v4.2 + keygen axxo.exe
%System Root%\Downloads\G-Force Platinum v3.7.5.exe
%System Root%\Downloads\Divx Pro 7 + keymaker.exe
%System Root%\Downloads\Magic Video Converter 8 0 2 18.exe
%System Root%\Downloads\Sophos antivirus updater bypass.exe
%System Root%\Downloads\DVD Tools Nero 10.5.6.0.exe
%System Root%\Downloads\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
%System Root%\Downloads\PDF password remover (works with all acrobat reader).exe
%System Root%\Downloads\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe
%System Root%\Downloads\Windows2008 keygen and activator.exe
%System Root%\Downloads\Tuneup Ultilities 2010.exe
%System Root%\Downloads\Kaspersky Internet Security 2010 keygen.exe
%System Root%\Downloads\Windows XP PRO Corp SP3 valid-key generator.exe
%System Root%\Downloads\Starcraft2 Patch v0.2.exe
%System Root%\Downloads\Starcraft2 keys.txt.exe
%System Root%\Downloads\Starcraft2 Crack.exe
%System Root%\Downloads\Starcraft2 Oblivion DLL.exe
%System Root%\Downloads\Starcraft2.exe

(註：%System%はWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 98 および MEの場合、"C:\Windows\System"、Windows NT および 2000 の場合、"C:\WinNT\System32"、Windows XP および Server 2003 の場合、"C:\Windows\System32" です。. %Program Files%は、標準設定では "C:\Program Files" です。. %System Root%は、標準設定では "C:" です。また、オペレーティングシステムが存在する場所です。)

ワームは、以下のフォルダを作成します。

%Program Files%\Mozilla Firefox
%Program Files%\Mozilla Firefox\extensions
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content
%User Profile%\Application Data\SystemProc

(註：%Program Files%は、標準設定では "C:\Program Files" です。. %User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。)

自動実行方法

ワームは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Reader Updater6 = "%System%\AdobeARMI.exe"

他のシステム変更

ワームは、以下のレジストリキーを追加します。

HKEY_LOCAL_MACHINE\Software\Microsoft\
Adobe6

HKEY_CURRENT_USER\Software\Microsoft\
Adobe6

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run

ワームは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
adobe076 = "11"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
adobe086 = "22"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\AdobeARMI.exe = "%System%\AdobeARMI.exe:*:Enabled:Explorer"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UACDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
RTHDBPL = "%System%\adobereader.exe"

HKEY_CURRENT_USER\Identities
KillSelf = "ok"

HKEY_CURRENT_USER\Identities
Curr version = "25"

HKEY_CURRENT_USER\Identities
First Start = "%System%\adobereader.exe"

HKEY_CURRENT_USER\Identities
Last Date = "22-11-2011"

HKEY_CURRENT_USER\Identities
Send Inst = "ok"

HKEY_CURRENT_USER\Identities
Inst Date = "22-11-2011"

HKEY_CURRENT_USER\Identities
Popup count = "0"

HKEY_CURRENT_USER\Identities
Popup time = "0"

HKEY_CURRENT_USER\Identities
Popup date = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
RTHDBPL = "%User Profile%\SystemProc\lsass.exe"

作成活動

ワームは、以下のファイルを作成します。

%System%\AdobeARMI.exe
%System%\adobereader.exe
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
%User Profile%\SystemProc\lsass.exe

(註：%System%はWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 98 および MEの場合、"C:\Windows\System"、Windows NT および 2000 の場合、"C:\WinNT\System32"、Windows XP および Server 2003 の場合、"C:\Windows\System32" です。. %Program Files%は、標準設定では "C:\Program Files" です。. %User Profile% フォルダは、Windows 98 および MEの場合、"C:\Windows\Profiles\＜ユーザ名＞"、Windows NTでは、"C:\WINNT\Profiles\＜ユーザ名＞"、Windows 2000, XP, Server 2003の場合は、"C:\Documents and Settings\＜ユーザ名＞" です。)

このウイルス情報は、自動解析システムにより作成されました。

対応方法

対応検索エンジン: 9.200

手順 1

Windows XP および Windows Server 2003 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

Windowsをセーフモードで再起動します。

[ 詳細 ]

手順 3

このレジストリキーを削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

In HKEY_LOCAL_MACHINE\Software\Microsoft
- Adobe6

In HKEY_CURRENT_USER\Software\Microsoft
- Adobe6

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
- Run

手順 4

このレジストリ値を削除します。

[ 詳細 ]

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Adobe Reader Updater6 = "%System%\AdobeARMI.exe"

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
- adobe076 = "11"

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
- adobe086 = "22"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %System%\AdobeARMI.exe = "%System%\AdobeARMI.exe:*:Enabled:Explorer"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
- EnableLUA = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- UACDisableNotify = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
- RTHDBPL = "%System%\adobereader.exe"

In HKEY_CURRENT_USER\Identities
- KillSelf = "ok"

In HKEY_CURRENT_USER\Identities
- Curr version = "25"

In HKEY_CURRENT_USER\Identities
- First Start = "%System%\adobereader.exe"

In HKEY_CURRENT_USER\Identities
- Last Date = "22-11-2011"

In HKEY_CURRENT_USER\Identities
- Send Inst = "ok"

In HKEY_CURRENT_USER\Identities
- Inst Date = "22-11-2011"

In HKEY_CURRENT_USER\Identities
- Popup count = "0"

In HKEY_CURRENT_USER\Identities
- Popup time = "0"

In HKEY_CURRENT_USER\Identities
- Popup date = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
- RTHDBPL = "%User Profile%\SystemProc\lsass.exe"

このマルウェアが追加したレジストリ値の削除：

「レジストリエディタ」を起動します。
[スタート]-[ファイル名を指定して実行]を選択し、regedit と入力し、[OK]をクリックします。
※regedit は半角英数字で入力する必要があります（大文字／小文字は区別されません）。
「レジストリエディタ」の左側のパネルにある以下のフォルダをダブルクリックします。
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
右側のパネルで以下のレジストリ値を検索し、削除します。
Adobe Reader Updater6 = "%System%\AdobeARMI.exe"
「レジストリエディタ」の左側のパネルにある以下のフォルダをダブルクリックします。
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer
右側のパネルで以下のレジストリ値を検索し、削除します。
adobe076 = "11"
右側のパネルで以下のレジストリ値を検索し、削除します。
adobe086 = "22"
「レジストリエディタ」の左側のパネルにある以下のフォルダをダブルクリックします。
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile>AuthorizedApplications>List
右側のパネルで以下のレジストリ値を検索し、削除します。
%System%\AdobeARMI.exe = "%System%\AdobeARMI.exe:*:Enabled:Explorer"
「レジストリエディタ」の左側のパネルにある以下のフォルダをダブルクリックします。
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>system
右側のパネルで以下のレジストリ値を検索し、削除します。
EnableLUA = "0"
「レジストリエディタ」の左側のパネルにある以下のフォルダをダブルクリックします。
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center
右側のパネルで以下のレジストリ値を検索し、削除します。
UACDisableNotify = "1"
「レジストリエディタ」の左側のパネルにある以下のフォルダをダブルクリックします。
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Explorer>Run
右側のパネルで以下のレジストリ値を検索し、削除します。
RTHDBPL = "%System%\adobereader.exe"
「レジストリエディタ」の左側のパネルにある以下のフォルダをダブルクリックします。
HKEY_CURRENT_USER>Identities
右側のパネルで以下のレジストリ値を検索し、削除します。
KillSelf = "ok"
右側のパネルで以下のレジストリ値を検索し、削除します。
Curr version = "25"
右側のパネルで以下のレジストリ値を検索し、削除します。
First Start = "%System%\adobereader.exe"
右側のパネルで以下のレジストリ値を検索し、削除します。
Last Date = "22-11-2011"
右側のパネルで以下のレジストリ値を検索し、削除します。
Send Inst = "ok"
右側のパネルで以下のレジストリ値を検索し、削除します。
Inst Date = "22-11-2011"
右側のパネルで以下のレジストリ値を検索し、削除します。
Popup count = "0"
右側のパネルで以下のレジストリ値を検索し、削除します。
Popup time = "0"
右側のパネルで以下のレジストリ値を検索し、削除します。
Popup date = "0"
右側のパネルで以下のレジストリ値を検索し、削除します。
RTHDBPL = "%User Profile%\SystemProc\lsass.exe"
「レジストリエディタ」を閉じます。

手順 5

以下のファイルを検索し削除します。

[ 詳細 ]

コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。

%System%\AdobeARMI.exe
%System%\adobereader.exe
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
%User Profile%\SystemProc\lsass.exe

手順 6

以下のフォルダを検索し削除します。

[ 詳細 ]

フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。

%Program Files%\Mozilla Firefox
%Program Files%\Mozilla Firefox\extensions
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome
%Program Files%\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content
%User Profile%\Application Data\SystemProc

手順 7

コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「WORM_PROLACO.AC」と検出したファイルの検索を実行してください。検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

ご利用はいかがでしたか？　アンケートにご協力ください