AutoRun 變種病毒 (TR/Crypt.NSPI.Gen ; Win32/Delf.NDF worm) 解毒教學

[故事起源]：AutoRun 變種病毒 (TR/Crypt.NSPI.Gen ; Win32/Delf.NDF worm)

前幾天朋友來找我，說電腦無法開機，我就叫他把電腦帶過來讓我看一下，
發現是一開機就出現藍色畫面(BSOD)，而且安全模式無法進入，也是出現 BSOD，
本來是懷疑硬體有點問題，就跟他說重新安裝ＸＰ再測試看看，剛開始安裝好ＸＰ
還不覺得有異狀，直到安裝好 NOD32 防毒軟體重新開機後，才覺得怪怪的，
因為右下方工具列的 NOD32 圖示一直沒有出現，才開始去找原因了。

P.S: BSOD = Blue Screen Of Death

後來發現他的 D:\ ; E:\ ; 都感染了 AutoRun 病毒，本來以為清一清病毒就OK了，
結果正常模式是可以進入沒問題，但是安全模式卻一樣無法進入(還是出現BSOD)，
這時候頭大了(以為自己ＸＰ驅動程式沒安裝好)，再一次確認 C: D: E: 沒病毒後，
決定第二次重新安裝ＸＰ，這下學乖了，一安裝好ＸＰ，馬上測試安全模式是否能進入，
結果是可以，再安裝好 NOD32 重新開機後，右下方工具列的 NOD32 圖示也出現了，
再一次測試安全模式是否能進入，結果也可以，搞定收工。

不過前前後後讓我花了５～６個小時重灌二次ＸＰ，實在有點火大，
剛好有把病毒樣本保留下來，決定分析一下這隻病毒...

我寫這篇解毒教學的原因是因為這隻病毒真的很變態，各位看[發生症狀]就知道。
......................................................................Write by GaMNiA

[病毒檔名及位置]：
C:\autorun.inf (--> 病毒產生的，隱藏檔)
C:\jsneqyl.exe (--> 病毒名稱隨機產生，檔名不固定，隱藏檔)
C:\Program Files\meex.exe (--> 病毒名稱隨機產生，檔名不固定，隱藏檔)
C:\Program Files\Common Files\Microsoft Shared\faqvfrw.inf (--> 病毒名稱隨機產生，檔名不固定，隱藏檔)
C:\Program Files\Common Files\Microsoft Shared\bwumrhr.exe (--> 病毒名稱隨機產生，檔名不固定，隱藏檔)
C:\Program Files\Common Files\System\faqvfrw.inf (--> 病毒名稱隨機產生，檔名不固定，隱藏檔)
C:\Program Files\Common Files\System\gxfrbuc.exe (--> 病毒名稱隨機產生，檔名不固定，隱藏檔)

jsneqyl.exe , meex.exe , bwumrhr.exe , gxfrbuc.exe (檔案大小是：27311 Bytes，日期是 1985/11/12 AM 06:26)

[發生症狀]：
1. 會去感染 USB 隨身碟的根目錄和 C:\ ; D:\ ; E:\ ;...根目錄，產生 autorun.inf & ???????.exe
　 (病毒名稱隨機產生，檔名不固定，隱藏檔)，
　 如果你的根目錄原本就有 autorun.inf 的資料夾(或檔案)的話，他會自動將原本的 autorun.inf 重新命名為其他名稱，
　 再把自己的 autorun.inf 取代過去。而且此病毒主體檔案很小，才 26 KB，以前的 AutoRun 病毒大概都在 1xx~2xx KB。
2. 軟體執行會變慢，尤其是當你的隨身碟有使用防寫功能時(SD記憶卡可以防止檔案寫入)。
3. 會去修改登錄檔 IFEO 項目，造成某些工具軟體(HijackThis/SREng/AutoRuns/360safe/GHOST/IceSword...等等)
　 或防毒軟體(AVAST/AVP/KAV/NOD32/NAV/KV/RAV...等等)無法執行。
4. 會去修改登錄檔，造成隱藏檔無法顯示。
5. 會自動停用「ＸＰ內建的防火牆」和「資訊安全中心」的服務。
6. 有時候會出現 svchost.exe 程式錯誤訊息視窗。(猜測是病毒本身加殼相容性還不夠完善，造成 svchost.exe 崩潰)
7. 有時候開機會出現藍色畫面(BSOD)，並且造成安全模式無法進入(也是出現BSOD)。
　 類似出現：STOP:0x0000007B (0x0F8968528,0xC0000034,0x00000000,0x00000000)

目前 Avira(小紅傘) 和 NOD32 雖然都可以掃到這隻病毒，
可是卻無法修復被修改的 IFEO 登錄碼和安全模式無法進入的問題。

P.S: IFEO = Image File Execution Options






[所需工具軟體]：
1. ＸＰ本身程式：TASKKILL.exe ; REGEDIT.exe ; SC.exe ; CMD.exe ; NOTEPAD.exe (記事本) ; DEL 指令
2. SREng (System Repair Engineer) 請自行到下面網址下載：
http://www.kztechs.com/sreng/download.html

[修復步驟]：

1. 按 [Ctrl] + [Alt] + [Del] 叫出工作管理員，可以發現發作中病毒的程序，bwumrhr.exe & gxfrbuc.exe
用ＸＰ本身的終止程序 TASKKILL.exe 同時中止發作中病毒的程序，bwumrhr.exe & gxfrbuc.exe

語法:
先到「開始」->「執行」-> 輸入：CMD -> 按「確定」-> 進入命令提示字元
TASKKILL /F /T /IM gxfrbuc.exe /IM bwumrhr.exe

成功: 處理程序 PID ???? (是 PID ???? 的下層)已經成功終止了。
成功: 處理程序 PID ???? (是 PID ???? 的下層)已經成功終止了。


2. 刪除下列檔案（隱藏檔）： DEL /F (強制刪除唯讀檔) /Q (沈默模式，不再詢問) /AH (屬性：隱藏)

語法:
DEL /F /Q /AH "C:\autorun.inf"
DEL /F /Q /AH "C:\jsneqyl.exe"
DEL /F /Q /AH "C:\Program Files\meex.exe"
DEL /F /Q /AH "C:\Program Files\Common Files\Microsoft Shared\faqvfrw.inf"
DEL /F /Q /AH "C:\Program Files\Common Files\Microsoft Shared\bwumrhr.exe"
DEL /F /Q /AH "C:\Program Files\Common Files\System\faqvfrw.inf"
DEL /F /Q /AH "C:\Program Files\Common Files\System\gxfrbuc.exe"

3. 執行 REGEDIT.exe 刪除被加入的登錄碼，有很多 "Debugger"= 開頭的
bwumrhr.exe 是我這邊分析病毒時所產生的檔名，很有可能每個人都不一樣～

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]
"Debugger"="C:\\Program Files\\Common Files\\Microsoft Shared\\bwumrhr.exe"
　　　　　:
　　　　　:
(最下面有補充完整快速清除修復 IFEO 的登錄檔)
　　　　　:
下面這一項不要刪除，這是ＸＰ系統本來就有的，雖然它也有 "Debugger"= 開頭
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path]
"Debugger"="ntsd -d"
"GlobalFlag"="0x000010F0"


4. [修復隱藏檔無法顯示]:
將虛線以下內容剪下，貼到記事本，存成 "修復隱藏檔無法顯示.reg" ，存好後，用滑鼠左鍵連點二下匯入
--------------- 檔案 "修復隱藏檔無法顯示.reg" 開頭 ---------------
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
"HideFileExt"=dword:00000000
"SuperHidden"=dword:00000001
"ShowSuperHidden"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"CheckedValue"=dword:00000002
"DefaultValue"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
"DefaultValue"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt]
"CheckedValue"=dword:00000001
"DefaultValue"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""
--------------- 結尾　[修復隱藏檔無法顯示.reg]　結尾 ----------------


5. 使用ＸＰ本身的 SC.exe 命令，重新啟用 "ＸＰ內建的防火牆" 和 "資訊安全中心" 的服務
將虛線以下內容剪下，貼到記事本，存成 "啟用防火牆和資訊安全中心的服務.bat" ，存好後，用滑鼠左鍵連點二下執行
--------------- 檔案 "啟用防火牆和資訊安全中心的服務.bat" 開頭 --------------
Rem 啟用 "資訊安全中心" 的服務
SC config wscsvc start= auto
SC start wscsvc

Rem 啟用 "ＸＰ內建的防火牆" 的服務
SC config SharedAccess start= auto
SC start SharedAccess
-------------- 結尾　[啟用防火牆和資訊安全中心的服務.bat]　結尾 -------------


6. 執行 SREng 之前，必須先修復 IFEO 登錄碼，不然無法執行的。
執行 SREng -> 系統修復 -> 高級修復 -> 修復安全模式
SREng (System Repair Engineer) 請自行到下面網址下載：
http://www.kztechs.com/sreng/download.html


7. 清除病毒一開機就自動執行，病毒會自動加入下列登錄碼：
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"c:\\jsneqyl.exe"="jsneqyl"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"faqvfrw"="C:\\Program Files\\Common Files\\System\\gxfrbuc.exe"
"jsneqyl"="C:\\Program Files\\Common Files\\Microsoft Shared\\bwumrhr.exe"

將虛線以下內容剪下，貼到記事本，存成 "清除病毒開機自動執行.reg" ，存好後，用滑鼠左鍵連點二下匯入
--------------- 檔案 "清除病毒開機自動執行.reg" 開頭 ---------------
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"c:\\jsneqyl.exe"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"faqvfrw"=-
"jsneqyl"=-
--------------- 結尾　[清除病毒開機自動執行.reg]　結尾 ----------------

[快速清除修復 IFEO 的登錄檔 完整補充]:
將虛線以下內容剪下，貼到記事本，存成 "修復_IFEO.reg" ，存好後，用滑鼠左鍵連點二下匯入即可。
--------- 檔案 "修復_IFEO.reg" 開頭 ---------
Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastU3.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FYFireWall.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ghost.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\irsetup.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQSC.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upiea.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBCleaner.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zjb.exe]
---------------------- 結尾　"修復_IFEO.reg"　結尾 -------------------------