TROJ_PACKSKINTRIM_000002b.TOMA

To restart in Safe Mode:

• For Windows 2000 users

1. Restart your computer.
2. Press F8 when you see the Starting Windows bar at the bottom of the screen.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows XP users

1. Restart your computer.
2. Press F8 after the Power-On Self Test (POST) routine is done. If the Windows Advanced Options menu does not appear, try restarting then pressing F8 several times when the POST screen appears.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows Server 2003 users

1. Restart your computer.
2. Press F8 after Windows starts up. If the Windows Advanced Options menu does not appear, try restarting again and pressing F8 several times afterward.
3. On the Windows Advanced Option menu, use the arrow keys to select Safe Mode then press Enter.

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
3. Still in the left panel, locate and delete the key:
   IGB
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software
5. Still in the left panel, locate and delete the key:
   IGB
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
7. Still in the left panel, locate and delete the key:
   InternetGameBox
8. Again Still in the left panel, locate and delete the key:
   fcn
9. Again Still in the left panel, locate and delete the key:
   owfefn
10. Again Still in the left panel, locate and delete the key:
    LanConfig
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
12. Still in the left panel, locate and delete the key:
    {8CC497C9-A1DF-11CE-8098-00AA0047BE5D}
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8CC497C9-A1DF-11CE-8098-00AA0047BE5D}
14. Still in the left panel, locate and delete the key:
    1.0
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8CC497C9-A1DF-11CE-8098-00AA0047BE5D}>1.0
16. Still in the left panel, locate and delete the key:
    FLAGS
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8CC497C9-A1DF-11CE-8098-00AA0047BE5D}>1.0>0
18. Still in the left panel, locate and delete the key:
    win32
19. Again Still in the left panel, locate and delete the key:
    HELPDIR
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
21. Still in the left panel, locate and delete the key:
    {8CC497C0-A1DF-11CE-8098-00AA0047BE5D}
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C0-A1DF-11CE-8098-00AA0047BE5D}
23. Still in the left panel, locate and delete the key:
    ProxyStubClsid
24. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
25. Again Still in the left panel, locate and delete the key:
    TypeLib
26. Again Still in the left panel, locate and delete the key:
    {8CC497C2-A1DF-11CE-8098-00AA0047BE5D}
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C2-A1DF-11CE-8098-00AA0047BE5D}
28. Still in the left panel, locate and delete the key:
    ProxyStubClsid
29. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
30. Again Still in the left panel, locate and delete the key:
    TypeLib
31. Again Still in the left panel, locate and delete the key:
    {8CC497C1-A1DF-11CE-8098-00AA0047BE5D}
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C1-A1DF-11CE-8098-00AA0047BE5D}
33. Still in the left panel, locate and delete the key:
    ProxyStubClsid
34. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
35. Again Still in the left panel, locate and delete the key:
    TypeLib
36. Again Still in the left panel, locate and delete the key:
    {8CC497C3-A1DF-11CE-8098-00AA0047BE5D}
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C3-A1DF-11CE-8098-00AA0047BE5D}
38. Still in the left panel, locate and delete the key:
    ProxyStubClsid
39. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
40. Again Still in the left panel, locate and delete the key:
    TypeLib
41. Again Still in the left panel, locate and delete the key:
    {8CC497C4-A1DF-11CE-8098-00AA0047BE5D}
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C4-A1DF-11CE-8098-00AA0047BE5D}
43. Still in the left panel, locate and delete the key:
    ProxyStubClsid
44. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
45. Again Still in the left panel, locate and delete the key:
    TypeLib
46. Again Still in the left panel, locate and delete the key:
    {8CC497C5-A1DF-11CE-8098-00AA0047BE5D}
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C5-A1DF-11CE-8098-00AA0047BE5D}
48. Still in the left panel, locate and delete the key:
    ProxyStubClsid
49. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
50. Again Still in the left panel, locate and delete the key:
    TypeLib
51. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Identities>{341F68BA-C841-4200-A7B4-3D5CFF202166}>Software>Microsoft>Outlook Express>5.0
52. Still in the left panel, locate and delete the key:
    signatures
53. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   owfefn = "%Application Data%\owfefn.exe owfefn"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>IGB
5. In the right panel, locate and delete the entry:
   nums = "FCu_SSmAAA-FB0rWl0AAA"
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>IGB
7. In the right panel, locate and delete the entry:
   nums = "FCu_SSmAAA-FB0rWl0AAA"
8. Again In the right panel, locate and delete the entry:
   grpid = "875"
9. Again In the right panel, locate and delete the entry:
   grpid = "875"
10. Again In the right panel, locate and delete the entry:
    InstallOpt1 = "1"
11. Again In the right panel, locate and delete the entry:
    InstallOpt1 = "1"
12. Again In the right panel, locate and delete the entry:
    installdt = "20081206"
13. Again In the right panel, locate and delete the entry:
    installdt = "20081206"
14. Again In the right panel, locate and delete the entry:
    uai = "{random characters}"
15. Again In the right panel, locate and delete the entry:
    dl_lg = "IT"
16. Again In the right panel, locate and delete the entry:
    dl_lg = "IT"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>InternetGameBox
18. In the right panel, locate and delete the entry:
    DisplayName = "InternetGameBox "
19. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\InternetGameBox\uninst.exe"
20. Again In the right panel, locate and delete the entry:
    UninstallString2 = "%Program Files%\InternetGameBox\uninst.exe /S"
21. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\InternetGameBox\InternetGameBox.exe"
22. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://www.{BLOCKED}etgamebox.com"
23. Again In the right panel, locate and delete the entry:
    Publisher = "OOO «Favorit»"
24. Again In the right panel, locate and delete the entry:
    Installer Language = "1033"
25. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>fcn
26. In the right panel, locate and delete the entry:
    gid = "875"
27. Again In the right panel, locate and delete the entry:
    cnid = "V4Nb4bUgSie8y5MG1mwFnw"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>owfefn
29. In the right panel, locate and delete the entry:
    DisplayName = "Favorit"
30. Again In the right panel, locate and delete the entry:
    UninstallString = "%Application Data%\owfefn.exe -uninstall"
31. Again In the right panel, locate and delete the entry:
    NoRemove = "0"
32. Again In the right panel, locate and delete the entry:
    NoModify = "1"
33. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
34. Again In the right panel, locate and delete the entry:
    idt = "201209260834"
35. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>LanConfig
36. In the right panel, locate and delete the entry:
    LAN = "UP"
37. Again In the right panel, locate and delete the entry:
    bnrid = "672125"
38. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Account Manager>Accounts
39. In the right panel, locate and delete the entry:
    ConnectionSettingsMigrated = "1"
40. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Identities>{341F68BA-C841-4200-A7B4-3D5CFF202166}>Software>Microsoft>Outlook Express>5.0
41. In the right panel, locate and delete the entry:
    StoreMigratedV5 = "1"
42. Again In the right panel, locate and delete the entry:
    Settings Upgraded = "7"
43. Again In the right panel, locate and delete the entry:
    Running = "1"
44. Again In the right panel, locate and delete the entry:
    AssociatedID = "{random values}"
45. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Account Manager
46. In the right panel, locate and delete the entry:
    Server ID = "4"
47. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>WAB>WAB4
48. In the right panel, locate and delete the entry:
    FirstRun = "1"
49. Again In the right panel, locate and delete the entry:
    OlkContactRefresh = "0"
50. Again In the right panel, locate and delete the entry:
    OlkFolderRefresh = "0"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C0-A1DF-11CE-8098-00AA0047BE5D}>TypeLib
52. In the right panel, locate and delete the entry:
    Version = "1.0"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C2-A1DF-11CE-8098-00AA0047BE5D}>TypeLib
54. In the right panel, locate and delete the entry:
    Version = "1.0"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C1-A1DF-11CE-8098-00AA0047BE5D}>TypeLib
56. In the right panel, locate and delete the entry:
    Version = "1.0"
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C3-A1DF-11CE-8098-00AA0047BE5D}>TypeLib
58. In the right panel, locate and delete the entry:
    Version = "1.0"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C4-A1DF-11CE-8098-00AA0047BE5D}>TypeLib
60. In the right panel, locate and delete the entry:
    Version = "1.0"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8CC497C5-A1DF-11CE-8098-00AA0047BE5D}>TypeLib
62. In the right panel, locate and delete the entry:
    Version = "1.0"
63. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Identities>{341F68BA-C841-4200-A7B4-3D5CFF202166}>Software>Microsoft>Outlook Express>5.0>Mail
64. In the right panel, locate and delete the entry:
    Attach VCard = "0"
65. Close Registry Editor.

To restore the registry value this malware/grayware/spyware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SessionInformation
3. In the right panel, locate the registry value:
   ProgramCount = "2"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ProgramCount = "2"
5. Again In the right panel, locate the registry value:
   ProgramCount = "1"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ProgramCount = "2"
7. Again In the right panel, locate the registry value:
   ProgramCount = "3"
8. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ProgramCount = "2"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
10. In the right panel, locate the registry value:
    Blob = "{random values}"
11. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
13. In the right panel, locate the registry value:
    Blob = "{random values}"
14. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
16. In the right panel, locate the registry value:
    Blob = "{random values}"
17. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4C95A9902ABE0777CED18D6ACCC3372D2748381E
19. In the right panel, locate the registry value:
    Blob = "{random values}"
20. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4BA7B9DDD68788E12FF852E1A024204BF286A8F6
22. In the right panel, locate the registry value:
    Blob = "{random values}"
23. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
25. In the right panel, locate the registry value:
    Blob = "{random values}"
26. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>47AFB915CDA26D82467B97FA42914468726138DD
28. In the right panel, locate the registry value:
    Blob = "{random values}"
29. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4463C531D7CCC1006794612BB656D3BF8257846F
31. In the right panel, locate the registry value:
    Blob = "{random values}"
32. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43F9B110D5BAFD48225231B0D0082B372FEF9A54
34. In the right panel, locate the registry value:
    Blob = "{random values}"
35. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43DDB1FFF3B49B73831407F6BC8B975023D07C50
37. In the right panel, locate the registry value:
    Blob = "{random values}"
38. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
40. In the right panel, locate the registry value:
    Blob = "{random values}"
41. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4072BA31FEC351438480F62E6CB95508461EAB2F
43. In the right panel, locate the registry value:
    Blob = "{random values}"
44. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
46. In the right panel, locate the registry value:
    Blob = "{random values}"
47. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>394FF6850B06BE52E51856CC10E180E882B385CC
49. In the right panel, locate the registry value:
    Blob = "{random values}"
50. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>36863563FD5128C7BEA6F005CFE9B43668086CCE
52. In the right panel, locate the registry value:
    Blob = "{random values}"
53. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>DirectDraw>MostRecentApplication
55. In the right panel, locate the registry value:
    Name = "iexplore.exe"
56. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Name = "iexplore.exe"
57. Again In the right panel, locate the registry value:
    ID = "4117b81"
58. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ID = "41107b81"
59. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Identities
60. In the right panel, locate the registry value:
    Last Username = "Main Identity"
61. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Last Username = "Main Identity"
62. Again In the right panel, locate the registry value:
    Last User ID = "{341F68BA-C841-4200-A7B4-3D5CFF202166}"
63. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Last User ID = "{C0FE0177-5693-4537-9331-A7402AD82D40}"
64. Again In the right panel, locate the registry value:
    Identity Login = "9853"
65. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Identity Login = "98053"
66. Again In the right panel, locate the registry value:
    Identity Ordinal = "2"
67. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Identity Ordinal = "1"
68. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %User Temp%\nsk2.tmp
   • %User Temp%\nsa3.tmp\LangDLL.dll
   • %User Temp%\nsa3.tmp\ioSpecial.ini
   • %User Temp%\nsa3.tmp\modern-wizard.bmp
   • %User Temp%\nsa3.tmp\modern-header.bmp
   • %User Temp%\nsa3.tmp\InstallOptions.dll
   • %Application Data%\owfefn.exe
   • %Program Files%\InternetGameBox\InternetGameBox.exe
   • %Program Files%\InternetGameBox\ressources\configv2_fr.xml
   • %Program Files%\InternetGameBox\ressources\configv2_en.xml
   • %Program Files%\InternetGameBox\ressources\configv2_es.xml
   • %Program Files%\InternetGameBox\skins\skinv2.skn
   • %Program Files%\InternetGameBox\language
   • %Start Menu%\Programs\InternetGameBox\InternetGameBox.lnk
   • %Start Menu%\Programs\InternetGameBox\Uninstall.lnk
   • %Desktop%\InternetGameBox.lnk
   • %Program Files%\InternetGameBox\uninst.exe
   • %Application Data%\owfefn.dat
   • %User Temp%\owfefnpi.tmp
   • %Application Data%\owfefn_m2s.xml
   • %Application Data%\owfefn_m2s.zl
   • %Application Data%\owfefn_s2m.zl
   • %Application Data%\owfefn_s2m.xml
   • %User Temp%\owfefnup.tmp
   • %User Temp%\owfefnpic.tmp
   • %Application Data%\owfefn_navps.dat
   • ressources\favoris\defaultv2.swf
   • %Program Files%\InternetGameBox\ressources\AttenteOn.html
   • %Program Files%\InternetGameBox\ressources\AttenteOff.html
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To delete malware/grayware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\nsa3.tmp
   • %Program Files%\InternetGameBox
   • %Program Files%\InternetGameBox\ressources
   • %Program Files%\InternetGameBox\skins
   • %Start Menu%\Programs\InternetGameBox
   • ressources
   • ressources\favoris
   • %Program Files%\InternetGameBox\ressources\favoris
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat the said steps for all folders listed.