PUA_FIXFILES.GA

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。 プログラムは、ユーザの手動インストールにより、コンピュータに侵入します。

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

プログラムは、ユーザの手動インストールにより、コンピュータに侵入します。

インストール

プログラムは、以下のフォルダを追加します。

• %Program Files%\Dll-Files.com Fixer
• %All Users Profile%\Start Menu\Programs\Dll-Files Fixer
• %Application Data%\dll-files.com
• %Application Data%\dll-files.com\Fixer
• %Application Data%\dll-files.com\Fixer\Version 1.0
• %User Temp%\is-{random characters}.tmp
• %User Temp%\is-{random characters}.tmp\_isetup

プログラムは、以下のファイルを作成します。

• %User Temp%\is-{random characters}.tmp\dffsetup.tmp
• %User Temp%\is-{random characters}.tmp\_isetup\_shfoldr.dll
• %Program Files%\Dll-Files.com Fixer\is-{random characters}.tmp
• %Program Files%\Dll-Files.com Fixer\Chinese_rcp.ini
• %Program Files%\Dll-Files.com Fixer\CleanSchedule.exe
• %Program Files%\Dll-Files.com Fixer\DLLFixer.exe
• %Program Files%\Dll-Files.com Fixer\Danish_rcp.ini
• %Program Files%\Dll-Files.com Fixer\Dutch_rcp.ini
• %Program Files%\Dll-Files.com Fixer\Finnish_rcp_fi.ini
• %Program Files%\Dll-Files.com Fixer\French_rcp.ini
• %Program Files%\Dll-Files.com Fixer\German_rcp.ini
• %Program Files%\Dll-Files.com Fixer\Italian_rcp.ini
• %Program Files%\Dll-Files.com Fixer\Japanese_rcp.ini
• %Program Files%\Dll-Files.com Fixer\Norwegian_rcp.ini
• %Program Files%\Dll-Files.com Fixer\Portuguese_rcp.ini
• %Program Files%\Dll-Files.com Fixer\RegCleanPro.dll
• %Program Files%\Dll-Files.com Fixer\Spanish_rcp.ini
• %Program Files%\Dll-Files.com Fixer\Swedish_rcp.ini
• %Program Files%\Dll-Files.com Fixer\TraditionalCn_rcp_zh-tw.ini
• %Program Files%\Dll-Files.com Fixer\eng_rcp.ini
• %Program Files%\Dll-Files.com Fixer\greek_rcp_el.ini
• %Program Files%\Dll-Files.com Fixer\install_left_image.bmp
• %Program Files%\Dll-Files.com Fixer\isxdl.dll
• %Program Files%\Dll-Files.com Fixer\korean_rcp_ko.ini
• %Program Files%\Dll-Files.com Fixer\polish_rcp_pl.ini
• %Program Files%\Dll-Files.com Fixer\portugese_rcp_pt.ini
• %Program Files%\Dll-Files.com Fixer\russian_rcp_ru.ini
• %Program Files%\Dll-Files.com Fixer\turkish_rcp_tr.ini
• %Program Files%\Dll-Files.com Fixer\unins000.dat
• %Program Files%\Dll-Files.com Fixer\unins000.exe
• %Program Files%\Dll-Files.com Fixer\unins000.msg
• %Program Files%\Dll-Files.com Fixer\xmllite.dll
• %Desktop%\Dll-Files Fixer.lnk
• %All Users Profile%\Start Menu\Programs\Dll-Files Fixer\Dll-Files Fixer.lnk
• %All Users Profile%\Start Menu\Programs\Dll-Files Fixer\Uninstall Dll-Files Fixer.lnk
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Dll-Files Fixer.lnk
• %Application Data%\dll-files.com\Fixer\Version 1.0\log_{system date}.log
• %Application Data%\dll-files.com\Fixer\Version 1.0\results.rcp
• %Application Data%\Logs\{random filename}.license.log
• %Windows%\Tasks\DLL-Files.Com Fixer_MONTHLY.job
• %Windows%\Tasks\DLL-Files.Com Fixer_Updates.job

自動実行方法

プログラムは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
RDReminder = "%Program Files%\Dll-Files.com Fixer\DLLFixer.exe -rem"

他のシステム変更

プログラムは、以下のレジストリキーを追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com\
Fixer

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com\
Fixer\Version 1.0

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0\LANG

プログラムは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
Inno Setup: Setup Version = "{version number} (u)"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
Inno Setup: App Path = "%Program Files%\Dll-Files.com Fixer"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
InstallLocation = "%Program Files%\Dll-Files.com Fixer\"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
Inno Setup: Icon Group = "Dll-Files Fixer"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
Inno Setup: User = "{username}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
Inno Setup: Selected Tasks = "desktopicon,quicklaunchicon"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
Inno Setup: Deselected Tasks = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
Inno Setup: Language = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
DisplayName = "Dll-Files Fixer"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
DisplayIcon = "%Program Files%\Dll-Files.com Fixer\DLLFixer.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
UninstallString = ""%Program Files%\Dll-Files.com Fixer\unins000.exe""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
QuietUninstallString = ""%Program Files%\Dll-Files.com Fixer\unins000.exe" /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
DisplayVersion = "{version number}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
Publisher = "Dll-Files.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
URLInfoAbout = "http://www.dll-files.com/fixer/"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
HelpLink = "http://www.dll-files.com/fixer/"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
InstallDate = "{system date}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
MajorVersion = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
MinorVersion = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Dll-Files Fixer_is1
UninstallString = ""%Program Files%\Dll-Files.com Fixer\unins000.exe" /silent"

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com\
Fixer\Version 1.0
utm_source = ""

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com\
Fixer\Version 1.0
utm_campaign = ""

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com\
Fixer\Version 1.0
RCPURL = "http://www.dll-files.com/get-fixer/?"

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com\
Fixer\Version 1.0
RENEWALURL = "http://www.dll-files.com/renew-subscriptions/?"

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com\
Fixer\Version 1.0
DLLFILENAME = ""

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0\LANG
LangCode = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com\
Fixer\Version 1.0\LANG
LangID = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\dll-files.com\
Fixer\Version 1.0
Expired = "0"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
FirstRun = "1"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StartAutoScanPMUI = "0"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
CurrentScanTime = "{hex value}"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
SetChkREmovableMedia = "1"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
SetChkSkipEmptyKeys = "1"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
ImprovementProgram = 1"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StartWhenWinBoots = "1"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
GoToSystemTrayOnClose = "0"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
ConfirmBkUps = "1"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StartScan = "0"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StartMinimized = "0"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
AutoRepair = "0"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StrLastScan = "{System date and time}"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StrLastScanResults = "{numbers}"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StrLastOptimizeTime = ""

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StrLatestRegDefrag = ""

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StrLatestRestorePoint = ""

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StrLastStartupOpt = ""

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
RegErrFoundTillDate = "{numbers}"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
RegErrsFixedTillDate = "{numbers}"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
RegErrsFixedLast = "{numbers}"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
ScheduledTime = ""

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
NumTimesRCPRunned = "{numbers}"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
ChkAgreeToUploadDLLs = "1"

HKEY_CURRENT_USER\Software\dll-files.com\
Fixer\Version 1.0
StrLastScanResults = "{numbers}"

その他

プログラムは、以下の不正なWebサイトにアクセスします。

• http://www.{BLOCKED}les.com/
• http://www.{BLOCKED}les.com/fixer/
• http://www.{BLOCKED}les.com/get-fixer/?
• http://www.{BLOCKED}les.com/renew-subscriptions/?
• http://www.{BLOCKED}les.com/thank-you-for-installing/?type={type}&langid={language}&down_file={data}