スパイウェアを駆除
2017年4月25日
依頼者：埼玉県さいたま市北区宮原町
対象機：Acer ASPIRE 3830T
OS:Windows10Home 64bit
症状：
起動してもデスクトップ上のアイコンをクリックしても反応しない．
タスクマネージャも起動しない．
作業：
chkdsk後にスパイウェアを駆除．正常にアプリが起動するようになるも削除ができない．→修復
Windowsのレジストリ修復．→『Search App by AskToolbar』を削除しようとすると『「指定されたアカウントは既に存在します」』
とメッセージが出て削除できない。→復元ポイントは壊れていて戻れない
Linuxでマウントするも一時ファイルは消せない
復元ポイントを用いて戻す→4/20 4:16のWindowsUpdateが失敗しており復元ポイントは壊れている模様．
2017 4/20 10:58
に復元ポイントの自動作成。壊れている為以降のWindowsUpdateが失敗。一度復元ポイントをすべて削除。作り直して再度本日の復元ポイントを作成。WindowsUpdateが実行可能になる。
MBAM中。
———-動作が異常に遅いので手始めに手動で削除して再起動———–
手動削除。
Macfeeは削除。
***** [ 削除サービス ] *****
APNMCP
***** [ 削除フォルダ ] *****
C:\Users\masashi\AppData\Local\AskPartnerNetwork
C:\Users\masashi\AppData\Local\GAMESDESKTOP
C:\ProgramData\apn
C:\ProgramData\AskPartnerNetwork
C:\ProgramData\IHProtectUpDate
C:\ProgramData\WindowsMangerProtect
C:\ProgramData\Application Data\apn
C:\ProgramData\Application Data\AskPartnerNetwork
C:\ProgramData\Application Data\IHProtectUpDate
C:\ProgramData\Application Data\WindowsMangerProtect
C:\Program Files (x86)\AskPartnerNetwork
C:\Program Files (x86)\PepperZip
C:\Program Files (x86)\predm
C:\Program Files (x86)\XTab
***** [ 削除レジストリ ] *****
HKLM\SYSTEM\CurrentControlSet\services\apnmcp
HKLM\SOFTWARE\Classes\protector_dll.Protector
HKLM\SOFTWARE\Classes\protector_dll.Protector.1
HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
[x64] HKLM\SOFTWARE\Classes\protector_dll.Protector
[x64] HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
HKLM\SOFTWARE\Classes\CLSID\{44CBC005-6243-4502-8A02-3A096A282664}
HKLM\SOFTWARE\Classes\CLSID\{80703783-E415-4EE3-AB60-D36981C5A6F1}
HKLM\SOFTWARE\Classes\CLSID\{D8278076-BC68-4484-9233-6E7F1628B56C}
HKLM\SOFTWARE\Classes\CLSID\{F297534D-7B06-459D-BC19-2DD8EF69297B}
HKLM\SOFTWARE\Classes\CLSID\{4F524A2D-5350-4500-76A7-7A786E7484D7}
HKLM\SOFTWARE\Classes\Interface\{80703783-E415-4EE3-AB60-D36981C5A6F1}
HKLM\SOFTWARE\Classes\Interface\{884189CF-7C10-41E8-A014-F7B2BE40AADB}
HKLM\SOFTWARE\Classes\Interface\{BD125908-5F10-409F-9C01-F2207CA18887}
HKLM\SOFTWARE\Classes\TypeLib\{9945959C-AAD8-4312-8B57-2DE11927E770}
HKLM\SOFTWARE\Classes\TypeLib\{EEA63863-87BC-4DCA-A5B5-EB97E3B04806}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects\{4F524A2D-5350-4500-76A7-7A786E7484D7}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4F524A2D-5350-4500-76A7-7A786E7484D7}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4F524A2D-5350-4500-76A7-7A786E7484D7}
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
[{4F524A2D-5350-4500-76A7-7A786E7484D7}]
HKU\.DEFAULT\Software\AskPartnerNetwork
HKU\S-1-5-21-4047063184-3685461329-3456632209-1000\Software\AskPartnerNetwork
HKU\S-1-5-18\Software\AskPartnerNetwork
HKCU\Software\AskPartnerNetwork
HKLM\SOFTWARE\AskPartnerNetwork
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
[x64] HKCU\Software\AskPartnerNetwork
[x64] HKLM\SOFTWARE\AskPartnerNetwork
HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\7AB5857A57A0687786597A857BFFFFFF
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8036C72171EF4ba46856BF57969F6A36
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\89BB7852687BDC34B9A81E01C7FF9173
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CBC85D72B148084ABE8C2F072F781F4
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CC5A38A64D6098468BC8395BA0EFF03
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DF9A1AC557F56c49B56F6B83E293C15
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A97C590397DCC454AA8923563BAB10E4
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B08932C78B697C244BE7BA3E6FF09B62
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D14A7F65792054F418578C78367D13F7
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DFE9F0BD163D827438CB6AD6B100EC48
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F739A19A8327dc64C9A8B641A9E89646
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\158D6D9E3FE81fa428925F22ACB3A965
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\15E6C514FEFC09f45BAFAAE1D7546ED4
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DB42320A8525634AA089F0BEC86473B
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\22468B0D6050b2e46B9C4B67A8F59577
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2251BF05A2F606d43BB064BD63CBD87E
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3255D95681398614190EDF0A4F3F77DB
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CDF313E9B28c944FBC7579CF4949414
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\71E54748EDD3dc1468548785DC856EDA
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\754590DD06DE8d249B526503432F99D4
[x64]
HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\7AB5857A57A0687786597A857BFFFFFF
[x64]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7AB5857A57A0687786597A857BFFFFFF
HKU\S-1-5-21-4047063184-3685461329-3456632209-1000\Software\Microsoft\Internet
Explorer\SearchScopes\{C642CFF4-5454-4C5A-8E90-7D8361375C2F}
HKCU\Software\Microsoft\Internet
Explorer\SearchScopes\{C642CFF4-5454-4C5A-8E90-7D8361375C2F}
[x64] HKCU\Software\Microsoft\Internet
Explorer\SearchScopes\{C642CFF4-5454-4C5A-8E90-7D8361375C2F}
HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\EdpDomStorage\hao123.com
HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\EdpDomStorage\izito.jp
HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\EdpDomStorage\jp.hao123.com
HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\DOMStorage\hao123.com
HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\DOMStorage\izito.jp
HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\DOMStorage\jp.hao123.com
[x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\EdpDomStorage\hao123.com
[x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\EdpDomStorage\izito.jp
[x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\EdpDomStorage\jp.hao123.com
[x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\DOMStorage\hao123.com
[x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\DOMStorage\izito.jp
[x64] HKCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet
Explorer\DOMStorage\jp.hao123.com
特急作業 救急 緊急対応はパソコン救急バスターズにお任せください
埼玉 パソコン修理 さいたま データ復旧 データ復元 パソコン救急バスターズデータ復元センター
〒330-0856
さいたま市大宮区三橋3-191-2 バスターズビル２F
TEL:048-657-9933
www.pc99.co.jp
