프로그램분석

[linkman Trojan.Downloader Ad.pkg] 설치 및 삭제로그 : 74ms / 2012-07-10

프로세스 천국 2012. 7. 10. 00:12

----------------------------------------------------------------------
Created by Windowexe.com , Logfile of WindowexeAllkiller
----------------------------------------------------------------------
Windows 7 Ultimate Service Pack 1(6.1.7601.65536)
Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz / 1,023.55 MB
Intel64 Family 6 Model 42 Stepping 7
Date : 2012-07-10
----------------------------------------------------------------------
DF000 C:\Program Files (x86)\addenbar\addenbar.dll
DF001 C:\Program Files (x86)\addenbar\addenbaragent.exe
DF002 C:\Program Files (x86)\addenbar\uninst_dg.exe
DF003 C:\Program Files (x86)\IGImageCodec\IGImageCodecUpdater.exe
DF004 C:\Program Files (x86)\IGImageCodec\uninst.exe
DF005 C:\Program Files (x86)\NameClean\PrivChk.dll
DF006 C:\Program Files (x86)\NameClean\PrivChkSvc.exe
DF007 C:\Program Files (x86)\NameClean\PrivChkUninst.exe
DF008 C:\Program Files (x86)\NameClean\PrivChkUpdate.exe
DF009 C:\Program Files (x86)\Racl\RaclSvc.exe
DF010 C:\Program Files (x86)\Racl\RaclTb.dll
DF011 C:\Program Files (x86)\Racl\RaclUninst.exe
DF012 C:\Program Files (x86)\Viewsystem\Viewsystem.exe
DF013 C:\Program Files (x86)\WinScare\uninst.exe
DF014 C:\Program Files (x86)\WinScare\winscrb.dll
DF015 C:\Program Files (x86)\WinScare\winscrr.exe
DF016 C:\Program Files (x86)\WinScare\winscrs.dll
DF017 C:\Program Files\addenbar\addenov.dll
DF018 C:\Users\Administrator\AppData\Roaming\winapp\Winapp for Windows\SetupUtil.dll
DF019 C:\Users\Administrator\AppData\Roaming\winapp\Winapp for Windows\winapp.exe
DF020 C:\Users\Administrator\Documents\CCLEANER[1]\CCLEANER.exe
DF021 C:\Windows\SysWOW64\svcigimg.da.exe
DF022 C:\Windows\SysWOW64\svcigimg.exe
DF023 C:\Windows\SysWOW64\svcscrwin.da.exe
DF024 C:\Windows\SysWOW64\svcscrwin.exe
----------------------------------------------------------------------
SC025 WinScare Service -/- WinScare Service -/- - -/-  -/- C:\Windows\SysWOW64\svcscrwin.exe
SC026 NameCleanSvc -/- NameClean Service Manager -/- - -/-  -/- C:\Program Files (x86)\NameClean\PrivChkSvc.exe
SC027 Windows WinScare Diagnostics Service -/- Windows WinScare Diagnostics Service -/- - -/-  -/- C:\Windows\SysWOW64\wdrwscsvc.exe
SC028 IGImageCodec Service -/- IGImageCodec Service -/- - -/-  -/- C:\Windows\SysWOW64\svcigimg.exe
----------------------------------------------------------------------
TS029 Media vision
----------------------------------------------------------------------
US030 winappll -/- C:\Users\Administrator\AppData\Roaming\winapp\Winapp for Windows\winapp.exe update
US031 addenbaragent -/- C:\Program Files (x86)\addenbar\addenbaragent.exe
LS032 Viewsystem.exe -/- C:\Program Files (x86)\Viewsystem\Viewsystem.exe
LS033 NameClean -/- C:\Program Files (x86)\NameClean\PrivChkUpdate.exe
LS034 Racl -/- C:\Program Files (x86)\Racl\RaclSvc.exe
----------------------------------------------------------------------
BH035 PrivChkCtrl Class -/- C:\Program Files (x86)\NameClean\PrivChk.dll -/- {8F41D63C-5D92-40FF-A203-4ACC9158E9A4}
BH036 addenbar Class -/- C:\Program Files (x86)\addenbar\addenbar.dll -/- {9A3D68DC-5557-46E0-BD7B-BF64B561BD96}
BH037 WinScare -/- C:\Program Files (x86)\WinScare\winscrb.dll -/- {A132DBCE-97A2-4f32-B191-93C7AF4002BC}
BH038 adden_ov -/- c:\PROGRA~1\addenbar\addenov.dll -/- {CC01FC6C-DCA0-4F39-B902-DF736EF8E5E9}
EXADD Shockwave Flash Object -/- C:\Windows\system32\Macromed\Flash\Flash64_11_1_102.ocx -/- {D27CDB6E-AE6D-11CF-96B8-444553540000}
EXADD PrivChkCtrl Class -/- C:\Program Files (x86)\NameClean\PrivChk.dll -/- {8F41D63C-5D92-40FF-A203-4ACC9158E9A4}
EXADD addenbar Class -/- C:\Program Files (x86)\addenbar\addenbar.dll -/- {9A3D68DC-5557-46E0-BD7B-BF64B561BD96}
EXADD WinScare -/- C:\Program Files (x86)\WinScare\winscrb.dll -/- {A132DBCE-97A2-4F32-B191-93C7AF4002BC}
EXADD 잠김영역복사 -/- C:\Program Files (x86)\Racl\RaclTB.dll -/- {BCE04A5B-2B7D-4F4B-BB8E-2A59611733DD}
EXADD adden_ov -/- c:\PROGRA~1\addenbar\addenov.dll -/- {CC01FC6C-DCA0-4F39-B902-DF736EF8E5E9}
EXADD Shockwave Flash Object -/- C:\Windows\SysWOW64\Macromed\Flash\Flash11g.ocx -/- {D27CDB6E-AE6D-11CF-96B8-444553540000}
----------------------------------------------------------------------
001: adcreative.naver.com/ad3/1039/1039181/Tmon_angel_Naver_475x100_**.***
002: adcreative.naver.com/ad3/1041/1041616/20120703_KOICA_280x150_1.**.***
003: adcreative.naver.com/ad3/css/min/adcast_v5.min.css?11*.***
004: adcreative.naver.com/ad3/css/min/common.min.css?11*.***
005: adcreative.naver.com/ad3/js/adcast/min/a110718.min.js?11*.***
006: adcreative.naver.com/ad3/js/min/da.min.js?11*.***
007: adcreative.naver.com/ad3/js/min/da.min.js?12*.***
008: adcreative.naver.com/ad3/js/min/da.picnic.min.js?11*.***
009: adcreative.naver.com/ad3/js/min/da.sibo.min.js?12*.***
010: adcreative.naver.com/ad3/system/adcast/usual/110215*.***
011: addendum.kr/request/app_install.php?mac=000C293ECD7F&ver=1.1.1.**.***
012: addendum.kr/request/instinfo.php?insttype=adde*.***
013: addendum.kr/request/pcheck.php?pid=ab002&fiel*.***
014: addendum.kr/request/pcheck.php?pid=ab002&fiel*.***
015: addendum.kr/request/pcheck.php?pid=ab002&fiel*.***
016: addendum.kr/request/pcheck.php?pid=ab002&fiel*.***
017: addendum.kr/request/query_list.php?ver=1.1.1.1&pid=ab002&instda**.***
018: addendum.kr/request/updatelived.php?ver=1.1.1.0&instdate=201207**.***
019: addenov.com/adn2/c_inst.asp?mac=000C293E*.***
020: addenov.com/adn2/ovn_o.asp?dll=1&isd*.***
021: addenov.com/adn2/ovn_o.asp?dll=1&isdate=2012*.***
022: addenov.com/adn2/ovn_o.asp?dll=1&isdate=2012*.***
023: adm.masterad.co.kr/app/setup.html?mode=exe*.***
024: b.scorecardresearch.com/p?c1=2&c2=7241469&c4=http%253A%252F%252**.***
025: b.scorecardresearch.com/p2?c1=2&c2=7241469&c4=http%253A%252F%25**.***
026: castbox.shopping.naver.com/index*.***
027: down.addendum.kr/down/1.1.1.0/addenbaragent*.***
028: down.addendum.kr/down/1.1.1.1/addenbar*.***
029: down.addenov.com/adn2/addenov*.***
030: down.addenov.com/adn2/setup*.***
031: down.addenov.com/adn2/uninstall*.***
032: download.winscare.net/apps/act.php?_pi=abcdecfa0f29324c2d7a91b2**.***
033: download.winscare.net/apps/act.php?_pi=abcdecfa0f29324c2d7a91b2**.***
034: download.winscare.net/apps/act.php?_pi=abcdecfa0f29324c2d7a91b2**.***
035: download.winscare.net/apps/act.php?a=bfcdf8152c3c63879ac4e0e202**.***
036: fastvaccine.co.kr/dbk*.***
037: fastvaccine.co.kr/mbk.php?v1=file&v2=00:0C:29:3E:C*.***
038: filter.winapp.kr/dbdownload/sit*.***
039: filter.winapp.kr/ndbdownload/nsit*.***
040: gamehanpan.co.kr/data/sp/check_wsc*.***
041: ilc.nbz.co.kr/install.asp?id=188&mac=000C293E*.***
042: kr.ads.yimg.com/adv/dot222*.***
043: kr.ads.yimg.com/adv/rightCur*.***
044: kr.yahoo.com/?ilc*.***
045: l.yimg.com/d/lib/3pm/cs_0.*.***
046: l.yimg.com/d/lib/bc/bcr_2.0.*.***
047: l.yimg.com/go/news/picture/2012/07/temp/20120709200742193689147**.***
048: l.yimg.com/ne/news3/pyramid/2012/07/09/rvrv27_t1_Image1_1341816**.***
049: l.yimg.com/nk/adv/emartmall/emartmall_CRSL1_120703*.***
050: l.yimg.com/nk/adv/ford/PA_ford_120621*.***
051: l.yimg.com/zz/combo?nn/lib/metro/g/core_yui_3.4.4.js&nn/lib/met**.***
052: l.yimg.com/zz/combo?nn/lib/metro/g/uicontrib/yui/yui_3.4.*.***
053: l1.yimg.com/dh/ap/default/120628/mdpartnership_0628*.***
054: l1.yimg.com/dh/ap/default/120705/wisdomhouse_0709*.***
055: l1.yimg.com/dh/ap/kr/fp/2012/07/1_14*.***
056: l1.yimg.com/dh/ap/kr/fp/2012/07/1_20*.***
057: l1.yimg.com/dh/ap/kr/fp/2012/07/w18*.***
058: l1.yimg.com/dh/ap/kr/fp/2012/07/w30*.***
059: l1.yimg.com/dh/ap/kr/fp/2012/07/w31*.***
060: l1.yimg.com/le/i/11st/20120627/0627_50*.***
061: l1.yimg.com/le/i/11st/20120705/0705_31*.***
062: l1.yimg.com/le/i/11st/20120706/0706_35*.***
063: l1.yimg.com/le/i/11st/20120706/0706_38*.***
064: l1.yimg.com/le/i/11st/20120709/0709_36*.***
065: l1.yimg.com/le/i/11st/20120709/0709_39*.***
066: lcs.naver.com/m?u=http%3A%2F%2Fww*.naver.com%2F&e=&i=&os=Win32&**.***
067: modenad.com/control/control_boot.php?mac=000C293ECD7F&ptr=Views**.***
068: modenad.com/control/deny*.***
069: modenad.com/control/pgmver*.***
070: modenad.com/control/src*.***
071: modenad.com/control/tab_view*.***
072: modenad.com/control/wpinfo*.***
073: modenad.com/web_setup/aabb_setup*.***
074: modenad.com/web_setup/ap_domain_no_view_all*.***
075: modenad.com/web_setup/op_close_no_site*.***
076: modenad.com/web_setup/sokpage*.***
077: modenad.com/web_setup/ta_onoff*.***
078: nameclean.co.kr/_app/app_action.php?pi=num01&gu=212F6A75157AEA2**.***
079: nv.ad.naver.com/adshow?unit=002AG&ac=4234389&src=1649634&t=i&du**.***
080: nv1.ad.naver.com/adshow?unit=0*.***
081: nv2.ad.naver.com/adshow?unit=0*.***
082: rightclick.co.kr/check_counter.php?pi=hana002&gu=212F6A75157AEA**.***
083: shopping.phinf.naver.net/201206/a9e43df9-3b82-4590-8342-beb6c4a**.***
084: shopping.phinf.naver.net/201206/f573831b-94b2-4b51-8a8b-decd88c**.***
085: shopping.phinf.naver.net/201207/2028eb3a-7e8b-41db-a5bf-589578e**.***
086: shopping.phinf.naver.net/201207/4c045758-f72a-4048-b9cf-27b2ba4**.***
087: shopping.phinf.naver.net/201207/4d6a2afc-e476-4bbc-a498-1311448**.***
088: shopping.phinf.naver.net/201207/718f0e35-b28f-4495-a530-5b43018**.***
089: shopping.phinf.naver.net/201207/9c0dcfe9-8581-41b9-b63f-67ba81c**.***
090: shopping.phinf.naver.net/201207/a89bf4d9-3fdd-461c-b296-1456d96**.***
091: shopping.phinf.naver.net/201207/b0a625bf-0709-4776-8d65-1627ca0**.***
092: shopping.phinf.naver.net/201207/bf1507ce-ce3f-48dd-b810-0e85928**.***
093: shopping.phinf.naver.net/201207/dda1663e-7481-4038-8ad7-8db5a31**.***
094: shopping.phinf.naver.net/201207/e7978cc5-9233-4bcd-b890-c1b5a8a**.***
095: static.naver.net/newscast/2012/0709/1013571123516852*.***
096: static.naver.net/newscast/2012/0709/205756-257099647*.***
097: static.naver.net/newscast/2012/0709/233713-442583230*.***
098: static.naver.net/www/favicon*.***
099: static.naver.net/www/u/2010/0226/nmms_175057954*.***
100: static.naver.net/www/u/2010/0705/nmms_182028713*.***
101: static.naver.net/www/u/2011/0113/nmms_155218801_c*.***
102: static.naver.net/www/u/2011/0224/nmms_1010225_c*.***
103: static.naver.net/www/u/2012/0619/nmms_161943765c*.***
104: static.naver.net/www/u/2012/0626/nmms_14510514*.***
105: static.naver.net/www/u/2012/0629/nmms_103319185c*.***
106: static.naver.net/www/u/2012/0702/nmms_145614661c*.***
107: static.naver.net/www/u/2012/0704/nmms_18135578c*.***
108: static.naver.net/www/u/2012/0705/nmms_11118287c*.***
109: static.naver.net/www/u/2012/0705/nmms_1728419c*.***
110: static.naver.net/www/u/2012/0705/nmms_173931630c*.***
111: static.naver.net/www/u/2012/0706/nmms_175249488c*.***
112: static.naver.net/www/u/2012/0706/nmms_18243223*.***
113: static.naver.net/www/u/2012/0706/nmms_18516979c*.***
114: static.naver.net/www/u/2012/0709/nmms_155127857*.***
115: static.naver.net/www/u/2012/0709/nmms_183150116*.***
116: static.naver.net/www/u/2012/0709/nmms_22235976*.***
117: static.naver.net/www/widget/NIA_navigation_v1.17*.***
118: static.nid.naver.com/login.nhn?svc=me&url=http%3A%2F%2Fww*.nave**.***
119: static.nid.naver.com/loginv2/blank.*.***
120: static.nid.naver.com/loginv2/commonLoginF*.***
121: static.nid.naver.com/loginv2/css/wwwl.css?2012*.***
122: static.nid.naver.com/loginv2/js/long_ww*.js?2012*.***
123: static.shopping.naver.net/co/css/v26/castbox_v26.css?d=20120508**.***
124: static.shopping.naver.net/co/js/v14/castbox-nclktag-min_v14.js?**.***
125: thumb.opencast.naver.net/opencast01/n/a/naver_story/20120706/13**.***
126: thumb.opencast.naver.net/opencast01/n/a/naver_story/20120706/14**.***
127: thumb.opencast.naver.net/opencast01/n/a/naver_story/20120709/10**.***
128: thumb.opencast.naver.net/opencast01/n/a/naver_story/20120709/10**.***
129: underdomains.com/banner/17390692074cf87d4569f1f*.***
130: underdomains.com/banner/index.*.***
131: underdomains.com/list.php?ver=1*.***
132: underdomains.com/partnership/11728712824ff2abfadb7fb.exe?_x=38f**.***
133: underdomains.com/partnership/11946696074f34ba9aea676.exe?_x=370**.***
134: underdomains.com/partnership/13093486664fbf6eeedb040.exe?_x=376**.***
135: underdomains.com/partnership/20515273974f32260821bce.exe?_x=36f**.***
136: underdomains.com/partnership/2900490504feacfacafb66.exe?_x=3803**.***
137: underdomains.com/partnership/6123568484fed6c833896f.exe?_x=385c**.***
138: underdomains.com/partnership/6233774504fbc475257c81.exe?_x=3780**.***
139: underdomains.com/partnership/6677262104fd00c621ec88.exe?_x=37b9**.***
140: underdomains.com/partnership/8023688954fe98fabbb9ae.exe?_x=3723**.***
141: underdomains.com/partnership/9013053904fcc20c19c197.exe?_x=3795**.***
142: ww*.cuya.kr/apps/act.php?a=becbf51127365c7f91bad5d9c3ddf5465e46**.***
143: ww*.cuya.kr/apps/act.php?a=d7f735678ec5f534194a7bbfdf174285b4e6**.***
144: ww*.cuya.kr/apps/setup/Setup_IGImageCodec*.***
145: ww*.cuya.kr/runs/do.php?a=d5f93a6d9ac8fd276e5486b8fd1e5783c7f72**.***
146: ww*.fastvaccine.co.kr/APP/pf_ck.php?v1=*.***
147: ww*.linkmam.pe.kr/data/game_download.php?file_path=/data/down/9**.***
148: ww*.modenad.com/control/control_install.php?mac=000C293ECD7F&pt**.***
149: ww*.modenad.com/control/deny*.***
150: ww*.modenad.com/control/iconsrc*.***
151: ww*.modenad.com/control/pgm/Viewsystem*.***
152: ww*.modenad.com/control/process*.***
153: ww*.modenad.com/control/src*.***
154: ww*.nameclean.co.kr/_app/nc_iectrl.php?gu=212F6A75157AEA22CC763**.***
155: ww*.nameclean.co.kr/_app/prg/nc*.***
156: ww*.naver.*.***
157: ww*.naver.com/css/atcmp_20120703*.***
158: ww*.naver.com/css/main_20120704.c*.***
159: ww*.naver.com/include/navercast.10/navercast.jso*.***
160: ww*.naver.com/include/newscast/press_opinion.js?t=1000*.***
161: ww*.naver.com/js/c/JEagleEyeClient_20120111.min.js*.***
162: ww*.naver.com/js/c/jindo2_all_20120503.min.js?2012*.***
163: ww*.naver.com/js/c/nlog_20120319.mi*.***
164: ww*.naver.com/js/c/ntop1_20120705.mi*.***
165: ww*.naver.com/js/c/ntop2_20120703.mi*.***
166: ww*.naver.com/js/c/ntop3_20120703.mi*.***
167: ww*.naver.com/js/reatcmp_20120703.*.***
168: ww*.winapp.kr/logData/Sinstall.php?mode=n&sitecode=S001&ver=1.0**.***
169: ww*.winapp.kr/newAdmin/user_members/management/STopappConfig.ph**.***
170: ww*.wizeniapp.com/apps/acab/D19.bin?_pi=b9cbdda6ee001c33495e667**.***
171: ww*.wizeniapp.com/apps/acab/D20.bin?_pi=b9cbdda6ee001c33495e667**.***
172: ww*.wizeniapp.com/apps/acab/D214.bin?_pi=b9cbdda6ee001c33495e66**.***
173: ww*.wizeniapp.com/apps/acab/D220.bin?_pi=b9cbdda6ee001c33495e66**.***
174: ww*.wizeniapp.com/apps/acab/D234.bin?_pi=b9cbdda6ee001c33495e66**.***
175: ww*.wizeniapp.com/apps/acab/D236.bin?_pi=b9cbdda6ee001c33495e66**.***
176: ww*.wizeniapp.com/apps/acab/D240.bin?_pi=b9cbdda6ee001c33495e66**.***
177: ww*.wizeniapp.com/apps/acab/D246.bin?_pi=b9cbdda6ee001c33495e66**.***
178: ww*.wizeniapp.com/apps/acab/D249.bin?_pi=b9cbdda6ee001c33495e66**.***
179: ww*.wizeniapp.com/apps/acab/D251.bin?_pi=b9cbdda6ee001c33495e66**.***
180: ww*.wizeniapp.com/apps/acab/D254.bin?_pi=b9cbdda6ee001c33495e66**.***
181: ww*.wizeniapp.com/apps/acab/D256.bin?_pi=b9cbdda6ee001c33495e66**.***
182: ww*.wizeniapp.com/apps/acab/D258.bin?_pi=b9cbdda6ee001c33495e66**.***
183: ww*.wizeniapp.com/apps/acab/D259.bin?_pi=b9cbdda6ee001c33495e66**.***
184: ww*.wizeniapp.com/apps/acab/D263.bin?_pi=b9cbdda6ee001c33495e66**.***
185: ww*.wizeniapp.com/apps/acab/D264.bin?_pi=b9cbdda6ee001c33495e66**.***
186: ww*.wizeniapp.com/apps/acab/D265.bin?_pi=b9cbdda6ee001c33495e66**.***
187: ww*.wizeniapp.com/apps/acab/D266.bin?_pi=b9cbdda6ee001c33495e66**.***
188: ww*.wizeniapp.com/apps/acab/D267.bin?_pi=b9cbdda6ee001c33495e66**.***
189: ww*.wizeniapp.com/apps/acab/D276.bin?_pi=b9cbdda6ee001c33495e66**.***
190: ww*.wizeniapp.com/apps/acab/D277.bin?_pi=b9cbdda6ee001c33495e66**.***
191: ww*.wizeniapp.com/apps/acab/D278.bin?_pi=b9cbdda6ee001c33495e66**.***
192: ww*.wizeniapp.com/apps/acab/D279.bin?_pi=b9cbdda6ee001c33495e66**.***
193: ww*.wizeniapp.com/apps/acab/D280.bin?_pi=b9cbdda6ee001c33495e66**.***
194: ww*.wizeniapp.com/apps/acab/D296.bin?_pi=b9cbdda6ee001c33495e66**.***
195: ww*.wizeniapp.com/apps/acab/D300.bin?_pi=b9cbdda6ee001c33495e66**.***
196: ww*.wizeniapp.com/apps/acab/D306.bin?_pi=b9cbdda6ee001c33495e66**.***
197: ww*.wizeniapp.com/apps/acab/D307.bin?_pi=b9cbdda6ee001c33495e66**.***
198: ww*.wizeniapp.com/apps/acab/D308.bin?_pi=b9cbdda6ee001c33495e66**.***
199: ww*.wizeniapp.com/apps/acab/D309.bin?_pi=b9cbdda6ee001c33495e66**.***
200: ww*.wizeniapp.com/apps/acab/D311.bin?_pi=b9cbdda6ee001c33495e66**.***
201: ww*.wizeniapp.com/apps/acab/D312.bin?_pi=b9cbdda6ee001c33495e66**.***
202: ww*.wizeniapp.com/apps/acab/D314.bin?_pi=b9cbdda6ee001c33495e66**.***
203: ww*.wizeniapp.com/apps/acab/D315.bin?_pi=b9cbdda6ee001c33495e66**.***
204: ww*.wizeniapp.com/apps/acab/D316.bin?_pi=b9cbdda6ee001c33495e66**.***
205: ww*.wizeniapp.com/apps/acab/D317.bin?_pi=b9cbdda6ee001c33495e66**.***
206: ww*.wizeniapp.com/apps/acab/D318.bin?_pi=b9cbdda6ee001c33495e66**.***
207: ww*.wizeniapp.com/apps/acab/D320.bin?_pi=b9cbdda6ee001c33495e66**.***
208: ww*.wizeniapp.com/apps/acab/D365.bin?_pi=b9cbdda6ee001c33495e66**.***
209: ww*.wizeniapp.com/apps/acab/D367.bin?_pi=b9cbdda6ee001c33495e66**.***
210: ww*.wizeniapp.com/apps/acab/D369.bin?_pi=b9cbdda6ee001c33495e66**.***
211: ww*.wizeniapp.com/apps/acab/D370.bin?_pi=b9cbdda6ee001c33495e66**.***
212: ww*.wizeniapp.com/apps/acab/D371.bin?_pi=b9cbdda6ee001c33495e66**.***
213: ww*.wizeniapp.com/apps/acab/D372.bin?_pi=b9cbdda6ee001c33495e66**.***
214: ww*.wizeniapp.com/apps/acab/D373.bin?_pi=b9cbdda6ee001c33495e66**.***
215: ww*.wizeniapp.com/apps/acab/D390.bin?_pi=b9cbdda6ee001c33495e66**.***
216: ww*.wizeniapp.com/apps/acab/D397.bin?_pi=b9cbdda6ee001c33495e66**.***
217: ww*.wizeniapp.com/apps/acab/D399.bin?_pi=b9cbdda6ee001c33495e66**.***
218: ww*.wizeniapp.com/apps/acab/D400.bin?_pi=b9cbdda6ee001c33495e66**.***
219: ww*.wizeniapp.com/apps/acab/D403.bin?_pi=b9cbdda6ee001c33495e66**.***
220: ww*.wizeniapp.com/apps/acab/D413.bin?_pi=b9cbdda6ee001c33495e66**.***
221: ww*.wizeniapp.com/apps/acab/D414.bin?_pi=b9cbdda6ee001c33495e66**.***
222: ww*.wizeniapp.com/apps/acab/D418.bin?_pi=b9cbdda6ee001c33495e66**.***
223: ww*.wizeniapp.com/apps/acab/D424.bin?_pi=b9cbdda6ee001c33495e66**.***
224: ww*.wizeniapp.com/apps/acab/D429.bin?_pi=b9cbdda6ee001c33495e66**.***
225: ww*.wizeniapp.com/apps/acab/D433.bin?_pi=b9cbdda6ee001c33495e66**.***
226: ww*.wizeniapp.com/apps/acab/D434.bin?_pi=b9cbdda6ee001c33495e66**.***
227: ww*.wizeniapp.com/apps/acab/D436.bin?_pi=b9cbdda6ee001c33495e66**.***
228: ww*.wizeniapp.com/apps/acab/D437.bin?_pi=b9cbdda6ee001c33495e66**.***
229: ww*.wizeniapp.com/apps/acab/D441.bin?_pi=b9cbdda6ee001c33495e66**.***
230: ww*.wizeniapp.com/apps/acab/D442.bin?_pi=b9cbdda6ee001c33495e66**.***
231: ww*.wizeniapp.com/apps/acab/D444.bin?_pi=b9cbdda6ee001c33495e66**.***
232: ww*.wizeniapp.com/apps/acab/D444.bin?_pi=b9cbdda6ee001c33495e66**.***
233: ww*.wizeniapp.com/apps/acab/D446.bin?_pi=b9cbdda6ee001c33495e66**.***
234: ww*.wizeniapp.com/apps/acab/D446.bin?_pi=b9cbdda6ee001c33495e66**.***
235: ww*.wizeniapp.com/apps/acab/D446.bin?_pi=b9cbdda6ee001c33495e66**.***
----------------------------------------------------------------------
TB039 잠김영역복사 -/- C:\Program Files (x86)\Racl\RaclTB.dll -/- {BCE04A5B-2B7D-4F4B-BB8E-2A59611733DD}
----------------------------------------------------------------------
----------------------------------------------------------------------
Deleted Files : 25
Remove Service : 4
Remove Startup Entry : 5
Remove Browser Helper Object : 4
Remove Toolbar : 1
----------------------------------------------------------------------
Remove these Entry in a WindowexeAllkiller.txt file. Save and Run.
WindowexeAllkiller Remove Database 2012-07-10
[01-HKCUREG]**winappll
[01-HKCUREG]**addenbaragent
[02-HKLMREG]**Viewsystem.exe
[02-HKLMREG]**NameClean
[02-HKLMREG]**Racl
[03-BHOCLSD]**{8F41D63C-5D92-40FF-A203-4ACC9158E9A4}
[03-BHOCLSD]**{9A3D68DC-5557-46E0-BD7B-BF64B561BD96}
[03-BHOCLSD]**{A132DBCE-97A2-4f32-B191-93C7AF4002BC}
[03-BHOCLSD]**{CC01FC6C-DCA0-4F39-B902-DF736EF8E5E9}
[04-TOOLBAR]**{BCE04A5B-2B7D-4F4B-BB8E-2A59611733DD}
[05-SERVICE]**WinScare Service
[05-SERVICE]**NameCleanSvc
[05-SERVICE]**Windows WinScare Diagnostics Service
[05-SERVICE]**IGImageCodec Service
----------------------------------------------------------------------
Total Processing Time : 74ms
----------------------------------------------------------------------