TSPY_DOWNLOADER_CK200005.UVPA
プラットフォーム:
Windows 2000, Windows XP, Windows Server 2003
危険度:
感染確認数:
システムへの影響:
情報漏えい:
マルウェアタイプ:
スパイウェア
破壊活動の有無:
なし
暗号化:
感染報告の有無 :
はい
概要
スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
詳細
ファイルサイズ 1,799,376 bytes
タイプ EXE
メモリ常駐 はい
発見日 2014年2月18日
侵入方法
スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
インストール
スパイウェアは、以下のフォルダを作成します。
- %User Temp%\baidu_secure
- %User Temp%\baidu_secure\update
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915
- HtmlScreens
- %User Profile%\Application Data\Babylon
- %Program Files%\Babylon
- %Program Files%\Babylon\Babylon-Pro
- %Application Data%\Babylon
- %Application Data%\Babylon\Setup
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\HtmlScreens
- %System Root%\DOCUME~1
- %System Root%\DOCUME~1\Wilbert
- %User Profile%\LOCALS~1
- %User Temp%\nse56.tmp
- %User Temp%\nse56.tmp\skin
- %User Temp%\nse56.tmp\skin\common
- %Program Files%\Baidu Security
- %Program Files%\Baidu Security\PC Faster
- %Program Files%\Baidu Security\PC Faster\3.7.0.0
- %User Profile%\Documents
- %User Profile%\Documents\Baidu Security
- %User Profile%\Baidu Security\PC Faster
- %User Profile%\PC Faster\3.7.0.0
- %User Profile%\3.7.0.0\Dump
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\data
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BaiduSafe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BugReporter
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\confirm
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\feedback
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\nsis_install
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\screensnpashot
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\tools\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\update
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BaiduSafe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BugReporter
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\confirm
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\feedback
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\nsis_install
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\tools\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\update
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BaiduSafe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BugReporter
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\confirm
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\feedback
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\nsis_install
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\tools\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\update
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\common
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\confirm
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_boottime
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_crashreporter
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_frame
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_junkclean
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_popup
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInstall
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\common
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_feedback
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_update
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\GameFaster
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\NetworkSpeedTester
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginHome
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginOptimizer
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\log
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysRepair
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysAndNetworkOpt
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Tools\DefaultPrograms
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook\res
- %System Root%\Documents and Settings\Wilbert
- %Start Menu%\Programs\Baidu PC Faster
- %Start Menu%\Programs\Baidu PC Faster
(註：%User Temp%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 2000、XP および Server 2003 の場合、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞" です。. %Program Files%フォルダは、Windows 2000、Server 2003、XP (32ビット)、通常 Vista (32ビット) および 7 (32ビット) の場合、通常 "C:\Program Files"、Windows XP (64ビット)、Vista (64ビット) および 7 (64ビット) の場合、通常 "C:\Program Files (x86)" です。. %Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming" です。. %System Root%フォルダは、標準設定では "C:" です。また、オペレーティングシステムが存在する場所です。. %Start Menu%フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Windows\Start Menu" または "C:\Documents and Settings\＜ユーザ名＞\Start Menu"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu" です。)
自動実行方法
スパイウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Baidu PC Faster 3.7.0.0 = "{random characters}"
他のシステム変更
スパイウェアは、以下のファイルを削除します。
- %User Temp%\baidu_secure\update\newver_.xml
- %User Temp%\baidu_secure\update\newver.xml
- %User Profile%\Babylon\BabAll.dat.tmp
- %User Temp%\nsu52.tmp
- %User Temp%\nse56.tmp
- %Temp%\Plu174.tmp
- %Temp%\Plu17D.tmp
- %Temp%\Plu189.tmp
- %Temp%\Plu18D.tmp
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update\ProgramFileList.xml.7z
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update\PC_Faster_Setup.exe
(註：%User Temp%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 2000、XP および Server 2003 の場合、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞" です。. %Temp%フォルダは、標準設定では "C:\Windows\Temp" です。. %Program Files%フォルダは、Windows 2000、Server 2003、XP (32ビット)、通常 Vista (32ビット) および 7 (32ビット) の場合、通常 "C:\Program Files"、Windows XP (64ビット)、Vista (64ビット) および 7 (64ビット) の場合、通常 "C:\Program Files (x86)" です。)
スパイウェアは、以下のフォルダを削除します。
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.USBSafe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.HipsPop
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Tools\DefaultProgramsSetting
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SoftMgr
(註：%Program Files%フォルダは、Windows 2000、Server 2003、XP (32ビット)、通常 Vista (32ビット) および 7 (32ビット) の場合、通常 "C:\Program Files"、Windows XP (64ビット)、Vista (64ビット) および 7 (64ビット) の場合、通常 "C:\Program Files (x86)" です。)
スパイウェアは、以下のレジストリキーを追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\crp4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\crp4\
DEBUG
HKEY_CURRENT_USER\SOFTWARE\Baidu Security\
PC Faster
HKEY_CURRENT_USER\Software\BabyTest
HKEY_LOCAL_MACHINE\Software\BabyTest
HKEY_CLASSES_ROOT\Test.cap
HKEY_LOCAL_MACHINE\Software\Babylon\
Babylon Client
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\PC_Faster_Setup_082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\PC_Faster_Setup_082\
DEBUG
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
HKEY_CURRENT_USER\SOFTWARE\Baidu Security\
PC Faster\3.7.0.0\Install\
159375
HKEY_CURRENT_USER\SOFTWARE\Baidu Security\
PC Faster\3.7.0.0\Install\
161359
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster\Setup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\PCFasterSvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\PCFasterSvc\
DEBUG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\Updater
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\Updater\
DEBUG
スパイウェアは、以下のレジストリ値を追加します。
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster
pcfaster-id = "S-1-5-21-1645522239-1292428093-682003330-1003#0050569F5690"
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster
pcfaster-guid = "ed71edb6-8355-4c7b-933a-2c6a04d20853"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
InstallChannel = "epom1thIBDBundle"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
InstallTime = "2014-02-18 02:34:32"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\PCFasterSvc_{PCFaster_3.7.0.0}
Description = "Baidu PC Faster Service 3.7.0.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
DisplayName = "Baidu PC Faster"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
DisplayIcon = "%Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFaster.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
UninstallString = "%Program Files%\Baidu Security\PC Faster\3.7.0.0\UninstCaller.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
DisplayVersion = "3.7.1.41446"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
URLInfoAbout = "http://www.{BLOCKED}er.com/go.php?link=1&pos=about"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
Publisher = "Baidu, Inc."
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Baidu PC Faster 3.7.0.0
InstallDir = "%Program Files%\Baidu Security\PC Faster\3.7.0.0"
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster
InstallChannel = "epom1thIBDBundle"
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster
CurrentInstallVersion = "3.7.0.0"
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster
InstallTime = "2014-02-18 02:34:32"
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster\3.7.0.0\Install\
159375
url = "{random characters}"
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster\3.7.0.0\Install\
161359
url = "{random characters}"
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster
IsEverInstalled = "1"
HKEY_CURRENT_USER\Software\Baidu Security\
PC Faster\Setup
SetupResult = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\WindowsUpdate\
Auto Update
AUOptions = "1"
スパイウェアは、以下のレジストリ値を変更します。
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
EventMessageFile = "%System%\ESENT.dll"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
CategoryMessageFile = "%System%\ESENT.dll"
(註：変更前の上記レジストリ値は、「{random values}」となります。)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
CategoryCount = "1"
(註：変更前の上記レジストリ値は、「10」となります。)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
TypesSupported = "7"
(註：変更前の上記レジストリ値は、「7」となります。)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"
スパイウェアは、以下のレジストリキーを削除します。
HKEY_LOCAL_MACHINE\Software\Babylon
作成活動
スパイウェアは、以下のファイルを作成します。
- %User Temp%\uti1.exe
- %User Temp%\crp4.exe
- %User Temp%\uti7.exe
- %User Temp%\crpA.exe
- %User Profile%\RpData\2014-02-17 19_33_23_RpData.dat
- bab033.tbinst.dat
- bab091.norecovericon.dat
- bab148.spreg.dat
- bab307.sp_pop0.dat
- bab456.TB_OldWay.dat
- Babylon.dat
- BExternal.dll
- loading.html
- navError.html
- pBar.gif
- IEHelper.dll
- Setup.exe
- SetupStrings.dat
- sqlite3.dll
- bab187.wl.dat
- %Application Data%\Babylon\Setup\LatestBugFix.zpb
- LatestBugFix.dll
- LatestBugFix.aoi
- %Application Data%\Babylon\Setup\Setup2.zpb
- %User Temp%\nse54.tmp
- %User Temp%\nse56.tmp\System.dll
- %User Temp%\nse56.tmp\InstallCheck.dll
- %User Temp%\nse56.tmp\string.ini
- %User Temp%\nse56.tmp\NewFeatures.txt
- %User Temp%\nse56.tmp\DirectUI.dll
- %User Temp%\nse56.tmp\InstallUtility.dll
- %User Temp%\nse56.tmp\log.dll
- %User Temp%\nse56.tmp\url.ini
- %User Temp%\nse56.tmp\config.ini
- %User Temp%\nse56.tmp\Communication.dll
- %User Temp%\nse56.tmp\BHips.dll
- %User Temp%\nse56.tmp\skin\common\common.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFaster.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\BaiduStore.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFasterSvc.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\DirectUI.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\log.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\sqlite.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Updater.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Communication.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\LogReporter.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\dbghelp.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PopupTip.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\DataReport.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFasterHelper.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFasterFeedback.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\NewUpdater.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\LeakRepair.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\NSISInstall.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\ftex.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Bhbase.sys
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\BProtectEx.sys
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\BProtectEx64.sys
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\BHips.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\CrashReport.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\CrashUL.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\FasterNow.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\url.ini
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\version.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update_config.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\ProgramFileList.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\FasterNow.xml
- %User Profile%\3.7.0.0\config.ini
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\SdkConfig.ini
- %User Profile%\Dump\BugReportConfig.ini
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Uninstall.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\UninstCaller.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\data\mn.dat
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\data\rl.dat
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BaiduSafe\BaiduSafe.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BugReporter\BugReporter.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\confirm\confirm.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\feedback\feedback.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\nsis_install\nsis_install.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\screensnpashot\screensnpashot.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\tools\FasterNow\FasterNow.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\update\update.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BaiduSafe\BaiduSafe.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BugReporter\BugReporter.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\confirm\confirm.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\feedback\feedback.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\nsis_install\nsis_install.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\tools\FasterNow\FasterNow.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\update\update.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BaiduSafe\BaiduSafe.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BugReporter\BugReporter.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\confirm\confirm.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\feedback\feedback.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\nsis_install\nsis_install.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\tools\FasterNow\FasterNow.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\update\update.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\common\common.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\confirm\confirm.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_boottime\skin_boottime.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_crashreporter\skin_crashreporter.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_frame\skin_frame.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_junkclean\skin_junkclean.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_popup\skin_popup.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\FasterNow\FasterNow.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInstall\NSISInstall.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\common\common.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_feedback\skin_feedback.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_update\skin_update.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\0.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\1.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\10.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\2.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\3.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\4.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\5.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\6.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\7.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\8.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\9.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_checked_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_checked_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_exit_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_exit_hover.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_exit_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_disable.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_cancel_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_cancel_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_cancel_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_uninstall_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_uninstall_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_uninstall_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_uncheck_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_uncheck_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_down_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_hover_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_hover_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_normal_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_normal_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\cricle.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\cricle_animate.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_disable.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_disable_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_disable_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_down_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_down_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_finishing_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_finishing_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_finishing_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_hover_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_hover_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_normal_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_normal_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\language_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\language_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\language_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_disable.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_bk.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_bk2.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_install.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_titlebar.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\min_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\min_hover.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\min_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_disable_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_disable_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_disable_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_down_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_down_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_down_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_hover_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_hover_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_hover_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_normal_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_normal_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_normal_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_percent_0.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_percent_1.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_percent_2.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_pop_percent_0.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_pop_percent_1.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_pop_percent_2.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\outer_circle.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginHome\circle_progress.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginHome\drag_disable.cur
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginOptimizer\img_circle.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\PluginConfig.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home\Plugin_Home.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\Plugin_LeakRepair.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\LeakRepair.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\Plugin_Optimizer.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOptEngine.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optlist.dat
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.5.1.def.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.6.0.def.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.6.1.def.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.6.2.def.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\Plugin_SystemCleaner.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\CleanerEngine.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\t1.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\t2.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysRepair\SysRepair.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus\Plugin_Antivirus.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysAndNetworkOpt\SysAndNetworkOpt.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook\Plugin_Facebook.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook\res\res.bskin
- %Start Menu%\Programs\Baidu PC Faster\Baidu PC Faster.lnk
- %Start Menu%\Programs\Baidu PC Faster\Feedback.lnk
- %Start Menu%\Programs\Baidu PC Faster\Uninstall.lnk
- %Desktop%\Baidu PC Faster.lnk
- %User Profile%\RpData\2014-02-17 19_34_32_0173RpData.dat
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update_statistic.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update\server_respond.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update\ProgramFileList.xml
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\LatestBugFix.zpb
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\Setup2.zpb
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab033.tbinst.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab091.norecovericon.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab148.spreg.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab187.wl.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab307.sp_pop0.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab456.TB_OldWay.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\Babylon.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\BExternal.dll
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\HtmlScreens\loading.html
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\HtmlScreens\navError.html
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\HtmlScreens\pBar.gif
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\IEHelper.dll
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\LatestBugFix.aoi
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\LatestBugFix.dll
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\LatestBugFix.zpb
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\SetupStrings.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\sqlite3.dll
- %Temp%\Plu171.tmp
- %Temp%\Plu174.tmp
- %Temp%\Plu17D.tmp
- %Temp%\Plu189.tmp
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\LeakDB-x86-1033.tmp
- %Temp%\Plu18D.tmp
(註：%User Temp%フォルダはWindowsの種類とインストール時の設定などにより異なります。標準設定では、Windows 2000、XP および Server 2003 の場合、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %User Profile% フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザ名＞"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞" です。. %Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming" です。. %Program Files%フォルダは、Windows 2000、Server 2003、XP (32ビット)、通常 Vista (32ビット) および 7 (32ビット) の場合、通常 "C:\Program Files"、Windows XP (64ビット)、Vista (64ビット) および 7 (64ビット) の場合、通常 "C:\Program Files (x86)" です。. %Start Menu%フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Windows\Start Menu" または "C:\Documents and Settings\＜ユーザ名＞\Start Menu"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu" です。. %Desktop%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\デスクトップ"、Windows Vista および 7 の場合、"C:\Users\＜ユーザ名＞\デスクトップ" です。. %Temp%フォルダは、標準設定では "C:\Windows\Temp" です。)
その他
スパイウェアは、以下の不正なWebサイトにアクセスします。
- http://{BLOCKED}ad-faster.net/trackcnt/Fcy8kA2KFRCzHzbH/?data=L11066
- http://www.{BLOCKED}t2.com/at?{random characters}
- http://download.{BLOCKED}ty.baidu.co.th/newver_082.xml
- http://download.{BLOCKED}ty.baidu.co.th/PC_Faster_Setup_082.exe
- http://stat.{BLOCKED}tream.net/report.php?{random characters}
- http://stp.{BLOCKED}n.com/downloader.php?{random characters}
- http://stp.{BLOCKED}n.com/site/files/Setup9/dwr/latest/LatestBugFix.zpb
- http://stp.{BLOCKED}n.com/{random path}
このウイルス情報は、自動解析システムにより作成されました。
対応方法
対応検索エンジン: 9.300
手順 1
Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。
手順 2
Windowsをセーフモードで再起動します。
[ 詳細 ]
手順 3
不明なレジストリ値を削除します。
[ 詳細 ]
警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process
- crp4
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\crp4
- DEBUG
- In HKEY_CURRENT_USER\SOFTWARE\Baidu Security
- PC Faster
- In HKEY_CURRENT_USER\Software
- BabyTest
- In HKEY_LOCAL_MACHINE\Software
- BabyTest
- In HKEY_CLASSES_ROOT
- Test.cap
- In HKEY_LOCAL_MACHINE\Software\Babylon
- Babylon Client
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process
- PC_Faster_Setup_082
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\PC_Faster_Setup_082
- DEBUG
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- Baidu PC Faster 3.7.0.0
- In HKEY_CURRENT_USER\SOFTWARE\Baidu Security\PC Faster\3.7.0.0\Install
- 159375
- In HKEY_CURRENT_USER\SOFTWARE\Baidu Security\PC Faster\3.7.0.0\Install
- 161359
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster
- Setup
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process
- PCFasterSvc
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\PCFasterSvc
- DEBUG
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process
- Updater
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\Updater
- DEBUG
手順 4
このレジストリ値を削除します。
[ 詳細 ]
警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Baidu PC Faster 3.7.0.0 = "{random characters}"
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster
- pcfaster-id = "S-1-5-21-1645522239-1292428093-682003330-1003#0050569F5690"
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster
- pcfaster-guid = "ed71edb6-8355-4c7b-933a-2c6a04d20853"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu PC Faster 3.7.0.0
- InstallChannel = "epom1thIBDBundle"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu PC Faster 3.7.0.0
- InstallTime = "2014-02-18 02:34:32"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCFasterSvc_{PCFaster_3.7.0.0}
- Description = "Baidu PC Faster Service 3.7.0.0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu PC Faster 3.7.0.0
- DisplayName = "Baidu PC Faster"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu PC Faster 3.7.0.0
- DisplayIcon = "%Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFaster.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu PC Faster 3.7.0.0
- UninstallString = "%Program Files%\Baidu Security\PC Faster\3.7.0.0\UninstCaller.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu PC Faster 3.7.0.0
- DisplayVersion = "3.7.1.41446"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu PC Faster 3.7.0.0
- URLInfoAbout = "http://www.{BLOCKED}er.com/go.php?link=1&pos=about"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu PC Faster 3.7.0.0
- Publisher = "Baidu, Inc."
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu PC Faster 3.7.0.0
- InstallDir = "%Program Files%\Baidu Security\PC Faster\3.7.0.0"
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster
- InstallChannel = "epom1thIBDBundle"
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster
- CurrentInstallVersion = "3.7.0.0"
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster
- InstallTime = "2014-02-18 02:34:32"
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster\3.7.0.0\Install\159375
- url = "{random characters}"
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster\3.7.0.0\Install\161359
- url = "{random characters}"
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster
- IsEverInstalled = "1"
- In HKEY_CURRENT_USER\Software\Baidu Security\PC Faster\Setup
- SetupResult = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update
- AUOptions = "1"
手順 5
変更されたレジストリ値を修正します。
[ 詳細 ]
警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: EventMessageFile = "%System%\ESENT.dll"
To: EventMessageFile = ""{random values}""
- From: EventMessageFile = "%System%\ESENT.dll"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: CategoryMessageFile = "%System%\ESENT.dll"
To: CategoryMessageFile = ""{random values}""
- From: CategoryMessageFile = "%System%\ESENT.dll"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: CategoryCount = "1"
To: CategoryCount = ""10""
- From: CategoryCount = "1"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: TypesSupported = "7"
To: TypesSupported = ""7""
- From: TypesSupported = "7"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- UpdatesDisableNotify = "1"
手順 6
以下のファイルを検索し削除します。
[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。 - %User Temp%\uti1.exe
- %User Temp%\crp4.exe
- %User Temp%\uti7.exe
- %User Temp%\crpA.exe
- %User Profile%\RpData\2014-02-17 19_33_23_RpData.dat
- bab033.tbinst.dat
- bab091.norecovericon.dat
- bab148.spreg.dat
- bab307.sp_pop0.dat
- bab456.TB_OldWay.dat
- Babylon.dat
- BExternal.dll
- loading.html
- navError.html
- pBar.gif
- IEHelper.dll
- Setup.exe
- SetupStrings.dat
- sqlite3.dll
- bab187.wl.dat
- %Application Data%\Babylon\Setup\LatestBugFix.zpb
- LatestBugFix.dll
- LatestBugFix.aoi
- %Application Data%\Babylon\Setup\Setup2.zpb
- %User Temp%\nse54.tmp
- %User Temp%\nse56.tmp\System.dll
- %User Temp%\nse56.tmp\InstallCheck.dll
- %User Temp%\nse56.tmp\string.ini
- %User Temp%\nse56.tmp\NewFeatures.txt
- %User Temp%\nse56.tmp\DirectUI.dll
- %User Temp%\nse56.tmp\InstallUtility.dll
- %User Temp%\nse56.tmp\log.dll
- %User Temp%\nse56.tmp\url.ini
- %User Temp%\nse56.tmp\config.ini
- %User Temp%\nse56.tmp\Communication.dll
- %User Temp%\nse56.tmp\BHips.dll
- %User Temp%\nse56.tmp\skin\common\common.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFaster.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\BaiduStore.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFasterSvc.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\DirectUI.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\log.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\sqlite.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Updater.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Communication.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\LogReporter.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\dbghelp.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PopupTip.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\DataReport.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFasterHelper.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\PCFasterFeedback.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\NewUpdater.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\LeakRepair.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\NSISInstall.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\ftex.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Bhbase.sys
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\BProtectEx.sys
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\BProtectEx64.sys
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\BHips.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\CrashReport.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\CrashUL.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\FasterNow.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\url.ini
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\version.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update_config.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\ProgramFileList.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\FasterNow.xml
- %User Profile%\3.7.0.0\config.ini
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\SdkConfig.ini
- %User Profile%\Dump\BugReportConfig.ini
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Uninstall.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\UninstCaller.exe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\data\mn.dat
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\data\rl.dat
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BaiduSafe\BaiduSafe.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BugReporter\BugReporter.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\confirm\confirm.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\feedback\feedback.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\nsis_install\nsis_install.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\screensnpashot\screensnpashot.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\tools\FasterNow\FasterNow.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\update\update.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BaiduSafe\BaiduSafe.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BugReporter\BugReporter.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\confirm\confirm.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\feedback\feedback.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\nsis_install\nsis_install.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\tools\FasterNow\FasterNow.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\update\update.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BaiduSafe\BaiduSafe.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BugReporter\BugReporter.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\confirm\confirm.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\feedback\feedback.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\nsis_install\nsis_install.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\tools\FasterNow\FasterNow.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\update\update.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\common\common.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\confirm\confirm.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_boottime\skin_boottime.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_crashreporter\skin_crashreporter.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_frame\skin_frame.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_junkclean\skin_junkclean.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_popup\skin_popup.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\FasterNow\FasterNow.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInstall\NSISInstall.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\common\common.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_feedback\skin_feedback.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_update\skin_update.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\0.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\1.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\10.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\2.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\3.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\4.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\5.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\6.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\7.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\8.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\9.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_checked_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_checked_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_exit_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_exit_hover.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_exit_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_disable.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_cancel_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_cancel_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_cancel_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_uninstall_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_uninstall_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_uninstall_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_uncheck_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_uncheck_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_down_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_hover_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_hover_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_normal_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_normal_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\cricle.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\cricle_animate.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_disable.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_disable_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_disable_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_down_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_down_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_finishing_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_finishing_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_finishing_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_hover_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_hover_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_normal_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_normal_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\language_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\language_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\language_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_disable.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_over.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_bk.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_bk2.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_install.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_titlebar.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\min_down.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\min_hover.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\min_normal.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_disable_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_disable_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_disable_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_down_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_down_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_down_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_hover_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_hover_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_hover_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_normal_eng.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_normal_pu.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_normal_thai.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_percent_0.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_percent_1.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_percent_2.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_pop_percent_0.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_pop_percent_1.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_pop_percent_2.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\outer_circle.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginHome\circle_progress.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginHome\drag_disable.cur
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginOptimizer\img_circle.png
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\PluginConfig.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home\Plugin_Home.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\Plugin_LeakRepair.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\LeakRepair.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\Plugin_Optimizer.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOptEngine.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optlist.dat
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.5.1.def.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.6.0.def.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.6.1.def.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.6.2.def.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\Plugin_SystemCleaner.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\CleanerEngine.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\t1.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\t2.db
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysRepair\SysRepair.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus\Plugin_Antivirus.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus\res\res.bskin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysAndNetworkOpt\SysAndNetworkOpt.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook\Plugin_Facebook.dll
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook\res\res.bskin
- %Start Menu%\Programs\Baidu PC Faster\Baidu PC Faster.lnk
- %Start Menu%\Programs\Baidu PC Faster\Feedback.lnk
- %Start Menu%\Programs\Baidu PC Faster\Uninstall.lnk
- %Desktop%\Baidu PC Faster.lnk
- %User Profile%\RpData\2014-02-17 19_34_32_0173RpData.dat
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update_statistic.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update\server_respond.xml
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update\ProgramFileList.xml
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\LatestBugFix.zpb
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\Setup2.zpb
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab033.tbinst.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab091.norecovericon.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab148.spreg.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab187.wl.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab307.sp_pop0.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\bab456.TB_OldWay.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\Babylon.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\BExternal.dll
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\HtmlScreens\loading.html
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\HtmlScreens\navError.html
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\HtmlScreens\pBar.gif
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\IEHelper.dll
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\LatestBugFix.aoi
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\LatestBugFix.dll
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\LatestBugFix.zpb
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\SetupStrings.dat
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\sqlite3.dll
- %Temp%\Plu171.tmp
- %Temp%\Plu174.tmp
- %Temp%\Plu17D.tmp
- %Temp%\Plu189.tmp
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\LeakDB-x86-1033.tmp
- %Temp%\Plu18D.tmp
手順 7
以下のフォルダを検索し削除します。
[ 詳細 ]
フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。 - %User Temp%\baidu_secure
- %User Temp%\baidu_secure\update
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915
- HtmlScreens
- %User Profile%\Application Data\Babylon
- %Program Files%\Babylon
- %Program Files%\Babylon\Babylon-Pro
- %Application Data%\Babylon
- %Application Data%\Babylon\Setup
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest
- %User Temp%\7C5236D6-BAB0-7891-A01C-D3F78038F915\Latest\HtmlScreens
- %System Root%\DOCUME~1
- %System Root%\DOCUME~1\Wilbert
- %User Profile%\LOCALS~1
- %User Temp%\nse56.tmp
- %User Temp%\nse56.tmp\skin
- %User Temp%\nse56.tmp\skin\common
- %Program Files%\Baidu Security
- %Program Files%\Baidu Security\PC Faster
- %Program Files%\Baidu Security\PC Faster\3.7.0.0
- %User Profile%\Documents
- %User Profile%\Documents\Baidu Security
- %User Profile%\Baidu Security\PC Faster
- %User Profile%\PC Faster\3.7.0.0
- %User Profile%\3.7.0.0\Dump
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\data
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BaiduSafe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BugReporter
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\confirm
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\feedback
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\nsis_install
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\screensnpashot
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\tools\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\update
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BaiduSafe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BugReporter
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\confirm
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\feedback
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\nsis_install
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\tools\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\update
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BaiduSafe
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BugReporter
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\confirm
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\feedback
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\nsis_install
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\tools\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\update
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\common
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\confirm
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_boottime
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_crashreporter
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_frame
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_junkclean
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\skin_popup
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInstall
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\common
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_feedback
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_update
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\GameFaster
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\NetworkSpeedTester
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginHome
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginOptimizer
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\log
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysRepair
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus\res
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysAndNetworkOpt
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Tools
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Tools\DefaultPrograms
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook\res
- %System Root%\Documents and Settings\Wilbert
- %Start Menu%\Programs\Baidu PC Faster
- %Start Menu%\Programs\Baidu PC Faster
手順 8
コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「TSPY_DOWNLOADER_CK200005.UVPA」と検出したファイルの検索を実行してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。
手順 9
以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。
- %User Temp%\baidu_secure\update\newver_.xml
- %User Temp%\baidu_secure\update\newver.xml
- %User Profile%\Babylon\BabAll.dat.tmp
- %User Temp%\nsu52.tmp
- %User Temp%\nse56.tmp
- %Temp%\Plu174.tmp
- %Temp%\Plu17D.tmp
- %Temp%\Plu189.tmp
- %Temp%\Plu18D.tmp
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update\ProgramFileList.xml.7z
- %Program Files%\Baidu Security\PC Faster\3.7.0.0\update\PC_Faster_Setup.exe
手順 10
以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。
※註：マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。
- In HKEY_LOCAL_MACHINE\Software
- Babylon
ご利用はいかがでしたか？ アンケートにご協力ください