PUA_FUSIONCORE.GD
a variant of Win32/FusionCore.P potentially unwanted (ESET-NOD32)
Windows
Type de grayware:
Potentially Unwanted Application
Destructif:
Non
Chiffrement:
In the wild::
Oui
Overview
Wird möglicherweise manuell von einem Benutzer installiert.
Anschließend werden die heruntergeladenen Dateien ausgeführt. Dadurch können die bösartigen Routinen der heruntergeladenen Dateien auf dem betroffenen System aktiv werden.
Détails techniques
Übertragungsdetails
Wird möglicherweise manuell von einem Benutzer installiert.
Installation
Fügt die folgenden Ordner hinzu:
- %Program Files%\CravingExplorer
- %User Temp%\is-{random}.tmp
(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000, XP und Server 2003.)
Schleust die folgenden Dateien ein:
- %User Temp%\is-{random}.tmp\{Malware Name}.tmp
- %User Temp%\is-{random}.tmp\isxdl.dll
- %User Temp%\is-{random}.tmp\PQxLQBQ.dll
- %User Temp%\is-{random}.tmp\CESubProcess.exe
- %User Temp%\is-{random}.tmp\ja.xml
- %User Temp%\is-{random}.tmp\api-ms-win-core-console-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-datetime-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-debug-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-errorhandling-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-file-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-file-l1-2-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-file-l2-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-handle-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-heap-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-interlocked-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-libraryloader-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-localization-l1-2-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-memory-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-namedpipe-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-processenvironment-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-processthreads-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-processthreads-l1-1-1.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-profile-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-rtlsupport-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-string-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-synch-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-synch-l1-2-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-sysinfo-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-timezone-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-util-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-conio-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-convert-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-environment-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-filesystem-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-heap-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-locale-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-math-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-multibyte-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-private-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-process-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-runtime-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-stdio-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-string-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-time-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-utility-l1-1-0.dll
- %User Temp%\is-{random}.tmp\GdiPlus.dll
- %User Temp%\is-{random}.tmp\Lang-jp.dll
- %User Temp%\is-{random}.tmp\mfc140u.dll
- %User Temp%\is-{random}.tmp\mfcm140u.dll
- %User Temp%\is-{random}.tmp\msvcp140.dll
- %User Temp%\is-{random}.tmp\ucrtbase.dll
- %User Temp%\is-{random}.tmp\vcruntime140.dll
- %User Temp%\is-{random}.tmp\firefox.exe
- %User Temp%\is-{random}.tmp\CESubProcess.exe
- %User Temp%\is-{random}.tmp\ja.xml
- %User Temp%\is-{random}.tmp\api-ms-win-core-console-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-datetime-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-debug-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-errorhandling-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-file-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-file-l1-2-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-file-l2-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-handle-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-heap-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-interlocked-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-libraryloader-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-localization-l1-2-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-memory-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-namedpipe-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-processenvironment-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-processthreads-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-processthreads-l1-1-1.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-profile-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-rtlsupport-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-string-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-synch-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-synch-l1-2-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-sysinfo-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-timezone-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-core-util-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-conio-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-convert-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-environment-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-filesystem-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-heap-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-locale-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-math-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-multibyte-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-private-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-process-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-runtime-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-stdio-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-string-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-time-l1-1-0.dll
- %User Temp%\is-{random}.tmp\api-ms-win-crt-utility-l1-1-0.dll
- %User Temp%\is-{random}.tmp\GdiPlus.dll
- %User Temp%\is-{random}.tmp\Lang-jp.dll
- %User Temp%\is-{random}.tmp\mfc140u.dll
- %User Temp%\is-{random}.tmp\mfcm140u.dll
- %User Temp%\is-{random}.tmp\msvcp140.dll
- %User Temp%\is-{random}.tmp\ucrtbase.dll
- %User Temp%\is-{random}.tmp\vcruntime140.dll
- %User Temp%\is-{random}.tmp\firefox.exe
- %User Temp%\is-{random}.tmp\SetupFooooo-tcraft.exe
- %Favorites%\Fooooo - 検索、天気、ニュースが充実のスタートページ.url
- %User Temp%\is-{random}.tmp\Fooooo.url
- %Desktop%\Fooooo.url
- %Program Files%\CravingExplorer\unins000.dat
- %Program Files%\CravingExplorer\is-{random}.tmp
- %Program Files%\CravingExplorer\img\alpha\addressbar\is-{random}.tmp
- %Program Files%\CravingExplorer\img\alpha\fotter\is-{random}.tmp
- %Program Files%\CravingExplorer\img\alpha\searchbar\is-{random}.tmp
- %Program Files%\CravingExplorer\img\alpha\toolbar\is-{random}.tmp
- %Program Files%\CravingExplorer\img\default\addressbar\is-{random}.tmp
- %Program Files%\CravingExplorer\img\default\alert\is-{random}.tmp
- %Program Files%\CravingExplorer\img\default\app\is-{random}.tmp
- %Program Files%\CravingExplorer\img\default\fotter\is-{random}.tmp
- %Program Files%\CravingExplorer\img\default\statusbar\is-{random}.tmp
- %Program Files%\CravingExplorer\img\default\toolbar\is-{random}.tmp
- %Program Files%\CravingExplorer\img\simple-alpha\addressbar\is-{random}.tmp
- %Program Files%\CravingExplorer\img\simple-alpha\fotter\is-{random}.tmp
- %Program Files%\CravingExplorer\img\simple-alpha\searchbar\is-{random}.tmp
- %Program Files%\CravingExplorer\img\simple-alpha\toolbar\is-{random}.tmp
- %Program Files%\CravingExplorer\lib\is-{random}.tmp
- %Program Files%\CravingExplorer\locale\is-{random}.tmp
- %Program Files%\CravingExplorer\site-script\is-{random}.tmp
- %Program Files%\CravingExplorer\template\is-{random}.tmp
- %Program Files%\CravingExplorer\is-{random}.tmp
- %ProgramData%\Microsoft\Windows\Start Menu\Programs\CravingExplorer\Craving Explorer.lnk
- %ProgramData%\Microsoft\Windows\Start Menu\Programs\CravingExplorer\Craving Explorer ‚ðƒAƒ“ƒCƒ“ƒXƒg[ƒ‹‚·‚é.lnk
- %Desktop%\Craving Explorer.lnk
- %Application Data%\Microsoft\Internet Explorer\Quick Launch\Craving Explorer.lnk
- %Program Files%\CravingExplorer\unins000.dat
- %Program Files%\CravingExplorer\unins000.exe
- %Program Files%\CravingExplorer\Important.rtf
- %Program Files%\CravingExplorer\License.rtf
- %Program Files%\CravingExplorer\Readme.txt
- %Program Files%\CravingExplorer\img\alpha\addressbar\go.ico
- %Program Files%\CravingExplorer\img\alpha\fotter\convert-hot.ico
- %Program Files%\CravingExplorer\img\alpha\fotter\convert.ico
- %Program Files%\CravingExplorer\img\alpha\fotter\download-hot.ico
- %Program Files%\CravingExplorer\img\alpha\fotter\download.ico
- %Program Files%\CravingExplorer\img\alpha\searchbar\search.ico
- %Program Files%\CravingExplorer\img\alpha\toolbar\DisableIcons.png
- %Program Files%\CravingExplorer\img\alpha\toolbar\HotIcons.png
- %Program Files%\CravingExplorer\img\alpha\toolbar\Icons.png
- %Program Files%\CravingExplorer\img\default\addressbar\go.ico
- %Program Files%\CravingExplorer\img\default\alert\cache.ico
- %Program Files%\CravingExplorer\img\default\alert\convert.ico
- %Program Files%\CravingExplorer\img\default\alert\download.ico
- %Program Files%\CravingExplorer\img\default\alert\no_thumbnail.png
- %Program Files%\CravingExplorer\img\default\app\About.png
- %Program Files%\CravingExplorer\img\default\app\Download.png
- %Program Files%\CravingExplorer\img\default\app\DownloadClose.png
- %Program Files%\CravingExplorer\img\default\app\DownloadCloseHover.png
- %Program Files%\CravingExplorer\img\default\app\Warning.png
- %Program Files%\CravingExplorer\img\default\app\Web.ico
- %Program Files%\CravingExplorer\img\default\app\WizardIcon.png
- %Program Files%\CravingExplorer\img\default\fotter\cache-hot.ico
- %Program Files%\CravingExplorer\img\default\fotter\cache.ico
- %Program Files%\CravingExplorer\img\default\fotter\contract.ico
- %Program Files%\CravingExplorer\img\default\fotter\convert-hot.ico
- %Program Files%\CravingExplorer\img\default\fotter\convert.ico
- %Program Files%\CravingExplorer\img\default\fotter\delete-hot.ico
- %Program Files%\CravingExplorer\img\default\fotter\delete.ico
- %Program Files%\CravingExplorer\img\default\fotter\down-hot.ico
- %Program Files%\CravingExplorer\img\default\fotter\down.ico
- %Program Files%\CravingExplorer\img\default\fotter\download-hot.ico
- %Program Files%\CravingExplorer\img\default\fotter\download.ico
- %Program Files%\CravingExplorer\img\default\fotter\expand.ico
- %Program Files%\CravingExplorer\img\default\fotter\up-hot.ico
- %Program Files%\CravingExplorer\img\default\fotter\up.ico
- %Program Files%\CravingExplorer\img\default\searchbar\craving.ico
- %Program Files%\CravingExplorer\img\default\searchbar\dailymotion.ico
- %Program Files%\CravingExplorer\img\default\searchbar\google.ico
- %Program Files%\CravingExplorer\img\default\searchbar\nicovideo.ico
- %Program Files%\CravingExplorer\img\default\searchbar\rakuten.ico
- %Program Files%\CravingExplorer\img\default\searchbar\search.ico
- %Program Files%\CravingExplorer\img\default\searchbar\yahoo.ico
- %Program Files%\CravingExplorer\img\default\searchbar\youtube.ico
- %Program Files%\CravingExplorer\img\default\statusbar\zoom.ico
- %Program Files%\CravingExplorer\img\default\toolbar\DisableIcons.png
- %Program Files%\CravingExplorer\img\default\toolbar\HotIcons.png
- %Program Files%\CravingExplorer\img\default\toolbar\Icons.png
- %Program Files%\CravingExplorer\img\simple-alpha\addressbar\go.ico
- %Program Files%\CravingExplorer\img\simple-alpha\fotter\convert-hot.ico
- %Program Files%\CravingExplorer\img\simple-alpha\fotter\convert.ico
- %Program Files%\CravingExplorer\img\simple-alpha\fotter\download-hot.ico
- %Program Files%\CravingExplorer\img\simple-alpha\fotter\download.ico
- %Program Files%\CravingExplorer\img\simple-alpha\searchbar\search.ico
- %Program Files%\CravingExplorer\img\simple-alpha\toolbar\DisableIcons.png
- %Program Files%\CravingExplorer\img\simple-alpha\toolbar\HotIcons.png
- %Program Files%\CravingExplorer\img\simple-alpha\toolbar\Icons.png
- %Program Files%\CravingExplorer\lib\CEConvert.exe
- %Program Files%\CravingExplorer\lib\COPYING.GPLv3
- %Program Files%\CravingExplorer\lib\COPYING.Libvpx
- %Program Files%\CravingExplorer\lib\Readme.txt
- %Program Files%\CravingExplorer\locale\en.xml
- %Program Files%\CravingExplorer\locale\ja.xml
- %Program Files%\CravingExplorer\site-script\Readme.txt
- %Program Files%\CravingExplorer\template\convert.xml
- %Program Files%\CravingExplorer\app.ini
- %Program Files%\CravingExplorer\api-ms-win-core-console-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-datetime-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-debug-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-errorhandling-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-file-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-file-l1-2-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-file-l2-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-handle-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-heap-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-interlocked-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-libraryloader-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-localization-l1-2-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-memory-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-namedpipe-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-processenvironment-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-processthreads-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-processthreads-l1-1-1.dll
- %Program Files%\CravingExplorer\api-ms-win-core-profile-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-rtlsupport-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-string-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-synch-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-synch-l1-2-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-sysinfo-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-timezone-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-core-util-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-conio-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-convert-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-environment-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-filesystem-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-heap-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-locale-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-math-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-multibyte-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-private-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-process-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-runtime-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-stdio-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-string-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-time-l1-1-0.dll
- %Program Files%\CravingExplorer\api-ms-win-crt-utility-l1-1-0.dll
- %Program Files%\CravingExplorer\CESubProcess.exe
- %Program Files%\CravingExplorer\concrt140.dll
- %Program Files%\CravingExplorer\CravingExplorer.exe
- %Program Files%\CravingExplorer\GdiPlus.dll
- %Program Files%\CravingExplorer\Lang-jp.dll
- %Program Files%\CravingExplorer\mfc140u.dll
- %Program Files%\CravingExplorer\mfcm140u.dll
- %Program Files%\CravingExplorer\msvcp140.dll
- %Program Files%\CravingExplorer\ucrtbase.dll
- %Program Files%\CravingExplorer\vcomp140.dll
- %Program Files%\CravingExplorer\vcruntime140.dll
(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000, XP und Server 2003.. %Favorites%ist der Ordner 'Favoriten' für den aktuellen Benutzer, normalerweise C:\Windows\Favoriten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Favoriten unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername}\Favoriten unter Windows 2000, XP und Server 2003.. %Desktop% ist der Ordner 'Desktop' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Desktop unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Desktop unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername}\Desktop unter Windows 2000, XP und Server 2003.. %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000, XP und Server 2003.)
Andere Systemänderungen
Fügt die folgenden Registrierungsschlüssel hinzu:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: Setup Version = "5.5.9 (a)"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: App Path = "%Program Files%\CravingExplorer"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
InstallLocation = "%Program Files%\CravingExplorer\"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: Icon Group = "CravingExplorer"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: User = "{username}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: Setup Type = "custom"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: Selected Components = "craving_explorer,mcafee,fooooo_sethome,fooooo_createshorcut,dayznewsreader"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: Deselected Components = "dayzweather"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: Selected Tasks = "desktopicon,quicklaunchicon"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: Deselected Tasks = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Inno Setup: Language = "Japanese"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
DisplayName = "Craving Explorer Version 1.8.6"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
UninstallString = "%Program Files%\CravingExplorer\unins000.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
QuietUninstallString = ""%Program Files%\CravingExplorer\unins000.exe" /SILENT"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
DisplayVersion = "1.8.6.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
Publisher = "T-Craft"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
URLInfoAbout = "http://www.crav-ing.com/"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
HelpLink = "http://www.crav-ing.com/"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
URLUpdateInfo = "http://www.crav-ing.com/"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
NoModify = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
NoRepair = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
MajorVersion = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
MinorVersion = 8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
VersionMajor = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
VersionMinor = 8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
EstimatedSize = 26003
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CravingExplorer_is1
InstallDate = "{Date}"
Ändert die folgenden Registrierungseinträge:
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = http://www.fooooo.com/
(Note: The default value data of the said registry entry is {user defined}.)
Download-Routine
Speichert die heruntergeladenen Dateien unter den folgenden Namen:
- %User Temp%\is-{random}.tmp\mcafee.exe
- %User Temp%\is-{random}.tmp\dayznewsreader.exe
(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000, XP und Server 2003.)
Anschließend werden die heruntergeladenen Dateien ausgeführt. Dadurch können die bösartigen Routinen der heruntergeladenen Dateien auf dem betroffenen System aktiv werden.
Solutions
Step 1
Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.
Step 3
Diesen Registrierungsschlüssel löschen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- CravingExplorer_is1
- CravingExplorer_is1
Step 4
Diesen geänderten Registrierungswert wiederherstellen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- From: Start Page = "http://www.fooooo.com/"
To: Start Page = "{user defined}"
- From: Start Page = "http://www.fooooo.com/"
Step 5
Diesen Ordner suchen und löschen
- %Program Files%\CravingExplorer
- %User Temp%\is-{random}.tmp
Step 6
Diese Dateien suchen und löschen
- %Favorites%\Fooooo - 検索、天気、ニュースが充実のスタートページ.url
- %Desktop%\Fooooo.url
- %ProgramData%\Microsoft\Windows\Start Menu\Programs\CravingExplorer\Craving Explorer.lnk
- %ProgramData%\Microsoft\Windows\Start Menu\Programs\CravingExplorer\Craving Explorer ‚ðƒAƒ“ƒCƒ“ƒXƒg[ƒ‹‚·‚é.lnk
- %Desktop%\Craving Explorer.lnk
- %Application Data%\Microsoft\Internet Explorer\Quick Launch\Craving Explorer.lnk
- %Favorites%\Fooooo - 検索、天気、ニュースが充実のスタートページ.url
- %Desktop%\Fooooo.url
- %ProgramData%\Microsoft\Windows\Start Menu\Programs\CravingExplorer\Craving Explorer.lnk
- %ProgramData%\Microsoft\Windows\Start Menu\Programs\CravingExplorer\Craving Explorer ‚ðƒAƒ“ƒCƒ“ƒXƒg[ƒ‹‚·‚é.lnk
- %Desktop%\Craving Explorer.lnk
- %Application Data%\Microsoft\Internet Explorer\Quick Launch\Craving Explorer.lnk
Step 7
Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als PUA_FUSIONCORE.GD entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.
Participez à notre enquête!