PUA.Win32.OfferCast.AUSWN

To delete the registry value this malware created:

1. Open Registry Editor. To do this:
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Tracing>Offercast391_ARS__RASAPI32
3. In the right panel, locate and delete the entry:
   EnableFileTracing = 0
4. Again In the right panel, locate and delete the entry:
   EnableConsoleTracing = 0
5. Again In the right panel, locate and delete the entry:
   FileTracingMask = 4294901760
6. Again In the right panel, locate and delete the entry:
   ConsoleTracingMask = 4294901760
7. Again In the right panel, locate and delete the entry:
   MaxFileSize = 1048576
8. Again In the right panel, locate and delete the entry:
   FileDirectory = %Windows%\tracing
9. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Tracing>Offercast391_ARS__RASMANCS
10. In the right panel, locate and delete the entry:
    EnableFileTracing = 0
11. Again In the right panel, locate and delete the entry:
    EnableConsoleTracing = 0
12. Again In the right panel, locate and delete the entry:
    FileTracingMask = 4294901760
13. Again In the right panel, locate and delete the entry:
    ConsoleTracingMask = 4294901760
14. Again In the right panel, locate and delete the entry:
    MaxFileSize = 1048576
15. Again In the right panel, locate and delete the entry:
    FileDirectoryFileDirectory = %Windows%\tracing
16. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows Script>Settings
17. In the right panel, locate and delete the entry:
    JITDebug = 0
18. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CURRENT_USER>Software>APN PIP>ARS
19. In the right panel, locate and delete the entry:
    PIP_Left = 708
20. Again In the right panel, locate and delete the entry:
    PIP_UI_Ready = 1
21. Again In the right panel, locate and delete the entry:
    PIP_Top = 248
22. Again In the right panel, locate and delete the entry:
    Left = 708
23. Again In the right panel, locate and delete the entry:
    Top = 248
24. Again In the right panel, locate and delete the entry:
    WFType = local
25. Again In the right panel, locate and delete the entry:
    WFPrimaryStatus = 1
26. Again In the right panel, locate and delete the entry:
    WFPrimaryOffers = P_ARSSPP_CN_L:Toolbar:media:local
27. Again In the right panel, locate and delete the entry:
    WFSecondaryStatus = 0
28. Again In the right panel, locate and delete the entry:
    WFSecondaryOffers =
29. Again In the right panel, locate and delete the entry:
    PIP_Toolbar_Selection = oi:1
30. Again In the right panel, locate and delete the entry:
    PIP_UI_Complete = 1
31. Again In the right panel, locate and delete the entry:
    PIP_Exit_Code = 0
32. Again In the right panel, locate and delete the entry:
    PIP_SkipAll = 0
33. Again In the right panel, locate and delete the entry:
    PIP_Toolbar_Launched =
34. Again In the right panel, locate and delete the entry:
    PIP_Toolbar_Exitcode =
35. Again In the right panel, locate and delete the entry:
    PIP_Offers_Launched =
36. Again In the right panel, locate and delete the entry:
    PIP_Offers_Exitcode =
37. Again In the right panel, locate and delete the entry:
    Show_UI = 1
38. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>CutePDF Writer Installation
39. In the right panel, locate and delete the entry:
    DisplayName = CutePDF Writer 3.1
40. Again In the right panel, locate and delete the entry:
    UninstallString = %Program Files%\Acro Software\CutePDF Writer\uninscpw.exe
41. Again In the right panel, locate and delete the entry:
    DisplayVersion = 3.1
42. Again In the right panel, locate and delete the entry:
    DisplayIcon = %Program Files%\Acro Software\CutePDF Writer\CuteEdit.ico
43. Again In the right panel, locate and delete the entry:
    Publisher = Acro Software Inc.
44. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Acro Software Inc>CutePDF Writer
45. In the right panel, locate and delete the entry:
    Destination Folder = %Program Files%\Acro Software\CutePDF Writer
46. Again In the right panel, locate and delete the entry:
    (Default) = %Program Files%\GNUGS
47. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>GPL Ghostscript>{Software Version}
48. In the right panel, locate and delete the entry:
    GS_LIB = %Program Files%\GPLGS
49. Again In the right panel, locate and delete the entry:
    GS_DLL = %Program Files%\GPLGS\gsdll32.dll
50. Close Registry Editor.

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Tracing
3. Still in the left panel, locate and delete the key:
   Offercast391_ARS__RASAPI32
4. Again Still in the left panel, locate and delete the key:
   Offercast391_ARS__RASMANCS
5. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>APN PIP
6. Still in the left panel, locate and delete the key:
   ARS
7. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
8. Still in the left panel, locate and delete the key:
   APN PIP
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
10. Still in the left panel, locate and delete the key:
    CutePDF Writer Installation
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Acro Software Inc
12. Still in the left panel, locate and delete the key:
    CutePDF Writer
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE
14. Still in the left panel, locate and delete the key:
    Acro Software Inc
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>GPL Ghostscript
16. Still in the left panel, locate and delete the key:
    {Software Version}
17. Again Still in the left panel, locate and delete the key:
    GPL Ghostscript
18. Close Registry Editor.

To delete malware/grayware files:

For Windows 7 and Server 2008 (R2), 8, 8.1, 10, and Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Temp%\is-{5 Random Characters}.tmp\_isetup\_shfoldr.dll
   • %User Temp%\is-{5 Random Characters}.tmp\Offercast391_ARS_.exe
   • %User Temp%\is-{5 Random Characters}.tmp\Setup.exe
   • %User Temp%\oc_{5 Random Characters}.tmp
   • %User Temp%\oc_{5 Random Characters}\OCDLL.dll
   • %User Temp%\oc_{5 Random Characters}.tmp
   • %User Temp%\oc_{5 Random Characters}\IEOS.dll
   • %User Temp%\oc_{5 Random Characters}\Start.htm
   • %User Temp%\oc_{5 Random Characters}\apnanalytic.js
   • %User Temp%\oc_{5 Random Characters}\download.htm
   • %User Temp%\oc_{5 Random Characters}\embeddownload.htm
   • %User Temp%\oc_{5 Random Characters}\embedmasterrule.js
   • %User Temp%\oc_{5 Random Characters}\embedoffer2xtemplate.htm
   • %User Temp%\oc_{5 Random Characters}\embedorchestrator.htm
   • %User Temp%\oc_{5 Random Characters}\images\CRPrimary2.png
   • %User Temp%\oc_{5 Random Characters}\images\CRSaturation1.png
   • %User Temp%\oc_{5 Random Characters}\images\FFPrimary2.png
   • %User Temp%\oc_{5 Random Characters}\images\FFSaturation1.png
   • %User Temp%\oc_{5 Random Characters}\images\IEPrimary2.png
   • %User Temp%\oc_{5 Random Characters}\images\IESaturation1.png
   • %User Temp%\oc_{5 Random Characters}\images\wait_animation.gif
   • %User Temp%\oc_{5 Random Characters}\masterrule.js
   • %User Temp%\oc_{5 Random Characters}\ocerror.js
   • %User Temp%\oc_{5 Random Characters}\offer2xtemplate.htm
   • %User Temp%\oc_{5 Random Characters}\offerlist.js
   • %User Temp%\oc_{5 Random Characters}\orchestrator.htm
   • %User Temp%\oc_{5 Random Characters}\prefetch.htm
   • %User Temp%\oc_{5 Random Characters}\progress.htm
   • %User Temp%\oc_{5 Random Characters}\reboot.htm
   • %User Temp%\oc_{5 Random Characters}\scrolltext.xml
   • %User Temp%\oc_{5 Random Characters}\wait_animation.gif
   • %User Temp%\oc_{5 Random Characters}\upgrade.zip
   • %User Temp%\oc_{5 Random Characters}\upgrade\upgrade\remoteapnanalytic.js
   • %User Temp%\oc_{5 Random Characters}\upgrade\remoteapnanalytic.js
   • %Program Files%\Acro Software\CutePDF Writer\README.HTM
   • %Program Files%\Acro Software\CutePDF Writer\PDFWrite.rsp
   • %Program Files%\Acro Software\CutePDF Writer\CuteEdit.ico
   • %Program Files%\Acro Software\CutePDF Writer\CPWSave.exe
   • %Program Files%\Acro Software\CutePDF Writer\uninscpw.exe
   • %System%\spool\drivers\w32x86\CUTEPDFW.PPD
   • %System%\spool\drivers\w32x86\PSCRIPT5.DLL
   • %System%\spool\drivers\w32x86\PS5UI.DLL
   • %System%\spool\drivers\w32x86\PSCRIPT.HLP
   • %System%\spool\drivers\w32x86\PSCRIPT.NTF
   • %System%\cpwmon2k.dll
   • %Common Programs%\CutePDF\PDF Writer\Readme.lnk
   • %User Temp%\converter.exe
   • %Program Files%\GPLGS\acctest.ps
   • %Program Files%\GPLGS\addxchar.ps
   • %Program Files%\GPLGS\afmdiff.awk
   • %Program Files%\GPLGS\align.ps
   • %Program Files%\GPLGS\bj8.rpd
   • %Program Files%\GPLGS\bj8gc12f.upp
   • %Program Files%\GPLGS\bj8hg12f.upp
   • %Program Files%\GPLGS\bj8oh06n.upp
   • %Program Files%\GPLGS\bj8pa06n.upp
   • %Program Files%\GPLGS\bj8pp12f.upp
   • %Program Files%\GPLGS\bj8ts06n.upp
   • %Program Files%\GPLGS\bjc610a0.upp
   • %Program Files%\GPLGS\bjc610a1.upp
   • %Program Files%\GPLGS\bjc610a2.upp
   • %Program Files%\GPLGS\bjc610a3.upp
   • %Program Files%\GPLGS\bjc610a4.upp
   • %Program Files%\GPLGS\bjc610a5.upp
   • %Program Files%\GPLGS\bjc610a6.upp
   • %Program Files%\GPLGS\bjc610a7.upp
   • %Program Files%\GPLGS\bjc610a8.upp
   • %Program Files%\GPLGS\bjc610b1.upp
   • %Program Files%\GPLGS\bjc610b2.upp
   • %Program Files%\GPLGS\bjc610b3.upp
   • %Program Files%\GPLGS\bjc610b4.upp
   • %Program Files%\GPLGS\bjc610b6.upp
   • %Program Files%\GPLGS\bjc610b7.upp
   • %Program Files%\GPLGS\bjc610b8.upp
   • %Program Files%\GPLGS\caption.ps
   • %Program Files%\GPLGS\cat.ps
   • %Program Files%\GPLGS\cbjc600.ppd
   • %Program Files%\GPLGS\cbjc800.ppd
   • %Program Files%\GPLGS\cdj550.upp
   • %Program Files%\GPLGS\cdj690.upp
   • %Program Files%\GPLGS\cdj690ec.upp
   • %Program Files%\GPLGS\cid2code.ps
   • %Program Files%\GPLGS\cidfmap
   • %Program Files%\GPLGS\decrypt.ps
   • %Program Files%\GPLGS\dnj750c.upp
   • %Program Files%\GPLGS\dnj750m.upp
   • %Program Files%\GPLGS\docie.ps
   • %Program Files%\GPLGS\dvipdf
   • %Program Files%\GPLGS\EndOfTask.ps
   • %Program Files%\GPLGS\eps2eps
   • %Program Files%\GPLGS\eps2eps.bat
   • %Program Files%\GPLGS\eps2eps.cmd
   • %Program Files%\GPLGS\FAPIconfig-FCO
   • %Program Files%\GPLGS\FCOfontmap-PCLPS3
   • %Program Files%\GPLGS\FCOfontmap-PS3
   • %Program Files%\GPLGS\font2c
   • %Program Files%\GPLGS\font2c.bat
   • %Program Files%\GPLGS\font2c.cmd
   • %Program Files%\GPLGS\font2c.ps
   • %Program Files%\GPLGS\font2pcl.ps
   • %Program Files%\GPLGS\Fontmap.ATB
   • %Program Files%\GPLGS\Fontmap.ATM
   • %Program Files%\GPLGS\Fontmap.OS2
   • %Program Files%\GPLGS\Fontmap.OSF
   • %Program Files%\GPLGS\Fontmap.SGI
   • %Program Files%\GPLGS\Fontmap.Sol
   • %Program Files%\GPLGS\Fontmap.Ult
   • %Program Files%\GPLGS\Fontmap.URW-136.T1
   • %Program Files%\GPLGS\Fontmap.URW-136.TT
   • %Program Files%\GPLGS\Fontmap.VMS
   • %Program Files%\GPLGS\ghostpdf.inf
   • %Program Files%\GPLGS\ghostpdf.ppd
   • %Program Files%\GPLGS\gsbj
   • %Program Files%\GPLGS\gsbj.bat
   • %Program Files%\GPLGS\gsdj
   • %Program Files%\GPLGS\gsdj.bat
   • %Program Files%\GPLGS\gsdj500
   • %Program Files%\GPLGS\gsdj500.bat
   • %Program Files%\GPLGS\gsdll32.dll
   • %Program Files%\GPLGS\gsdll32.lib
   • %Program Files%\GPLGS\gslj
   • %Program Files%\GPLGS\gslj.bat
   • %Program Files%\GPLGS\gslp
   • %Program Files%\GPLGS\gslp.bat
   • %Program Files%\GPLGS\gslp.ps
   • %Program Files%\GPLGS\gsnd
   • %Program Files%\GPLGS\gsnd.bat
   • %Program Files%\GPLGS\gsndt.bat
   • %Program Files%\GPLGS\gsnup.ps
   • %Program Files%\GPLGS\gssetgs.bat
   • %Program Files%\GPLGS\gssetgs32.bat
   • %Program Files%\GPLGS\gssetgs64.bat
   • %Program Files%\GPLGS\gst.bat
   • %Program Files%\GPLGS\gstt.bat
   • %Program Files%\GPLGS\gswin32c.exe
   • %Program Files%\GPLGS\gs_ce_e.ps
   • %Program Files%\GPLGS\gs_cmdl.ps
   • %Program Files%\GPLGS\gs_fform.ps
   • %Program Files%\GPLGS\gs_il2_e.ps
   • %Program Files%\GPLGS\gs_kanji.ps
   • %Program Files%\GPLGS\gs_ksb_e.ps
   • %Program Files%\GPLGS\gs_l.xbm
   • %Program Files%\GPLGS\gs_l.xpm
   • %Program Files%\GPLGS\gs_lgo_e.ps
   • %Program Files%\GPLGS\gs_lgx_e.ps
   • %Program Files%\GPLGS\gs_l_m.xbm
   • %Program Files%\GPLGS\gs_m.xbm
   • %Program Files%\GPLGS\gs_m.xpm
   • %Program Files%\GPLGS\gs_m_m.xbm
   • %Program Files%\GPLGS\gs_pfile.ps
   • %Program Files%\GPLGS\gs_rdlin.ps
   • %Program Files%\GPLGS\gs_s.xbm
   • %Program Files%\GPLGS\gs_s.xpm
   • %Program Files%\GPLGS\gs_s_m.xbm
   • %Program Files%\GPLGS\gs_t.xbm
   • %Program Files%\GPLGS\gs_t.xpm
   • %Program Files%\GPLGS\gs_t_m.xbm
   • %Program Files%\GPLGS\gs_wl1_e.ps
   • %Program Files%\GPLGS\gs_wl2_e.ps
   • %Program Files%\GPLGS\gs_wl5_e.ps
   • %Program Files%\GPLGS\ht_ccsto.ps
   • %Program Files%\GPLGS\image-qa.ps
   • %Program Files%\GPLGS\impath.ps
   • %Program Files%\GPLGS\Info-macos.plist
   • %Program Files%\GPLGS\jispaper.ps
   • %Program Files%\GPLGS\jobseparator.ps
   • %Program Files%\GPLGS\landscap.ps
   • %Program Files%\GPLGS\level1.ps
   • %Program Files%\GPLGS\lines.ps
   • %Program Files%\GPLGS\lp386.bat
   • %Program Files%\GPLGS\lp386r2.bat
   • %Program Files%\GPLGS\lpgs.bat
   • %Program Files%\GPLGS\lpr2.bat
   • %Program Files%\GPLGS\lprsetup.sh
   • %Program Files%\GPLGS\markhint.ps
   • %Program Files%\GPLGS\markpath.ps
   • %Program Files%\GPLGS\mkcidfm.ps
   • %Program Files%\GPLGS\necp2x.upp
   • %Program Files%\GPLGS\necp2x6.upp
   • %Program Files%\GPLGS\opdfread.ps
   • %Program Files%\GPLGS\packfile.ps
   • %Program Files%\GPLGS\pcharstr.ps
   • %Program Files%\GPLGS\pdf2dsc
   • %Program Files%\GPLGS\pdf2dsc.bat
   • %Program Files%\GPLGS\pdf2dsc.ps
   • %Program Files%\GPLGS\pdf2ps
   • %Program Files%\GPLGS\pdf2ps.bat
   • %Program Files%\GPLGS\pdf2ps.cmd
   • %Program Files%\GPLGS\PDFA_def.ps
   • %Program Files%\GPLGS\pdfopt
   • %Program Files%\GPLGS\pdfopt.bat
   • %Program Files%\GPLGS\pdfopt.ps
   • %Program Files%\GPLGS\pdfwrite.ps
   • %Program Files%\GPLGS\PDFX_def.ps
   • %Program Files%\GPLGS\pf2afm
   • %Program Files%\GPLGS\pf2afm.bat
   • %Program Files%\GPLGS\pf2afm.cmd
   • %Program Files%\GPLGS\pf2afm.ps
   • %Program Files%\GPLGS\pfbtopfa
   • %Program Files%\GPLGS\pfbtopfa.bat
   • %Program Files%\GPLGS\pfbtopfa.ps
   • %Program Files%\GPLGS\pftogsf.bat
   • %Program Files%\GPLGS\ppath.ps
   • %Program Files%\GPLGS\pphs
   • %Program Files%\GPLGS\pphs.ps
   • %Program Files%\GPLGS\prfont.ps
   • %Program Files%\GPLGS\printafm
   • %Program Files%\GPLGS\printafm.ps
   • %Program Files%\GPLGS\ps2ai.ps
   • %Program Files%\GPLGS\ps2ascii
   • %Program Files%\GPLGS\ps2ascii.bat
   • %Program Files%\GPLGS\ps2ascii.cmd
   • %Program Files%\GPLGS\ps2ascii.ps
   • %Program Files%\GPLGS\ps2epsi
   • %Program Files%\GPLGS\ps2epsi.bat
   • %Program Files%\GPLGS\ps2epsi.cmd
   • %Program Files%\GPLGS\ps2epsi.ps
   • %Program Files%\GPLGS\ps2pdf
   • %Program Files%\GPLGS\ps2pdf.bat
   • %Program Files%\GPLGS\ps2pdf.cmd
   • %Program Files%\GPLGS\ps2pdf12
   • %Program Files%\GPLGS\ps2pdf12.bat
   • %Program Files%\GPLGS\ps2pdf12.cmd
   • %Program Files%\GPLGS\ps2pdf13
   • %Program Files%\GPLGS\ps2pdf13.bat
   • %Program Files%\GPLGS\ps2pdf13.cmd
   • %Program Files%\GPLGS\ps2pdf14
   • %Program Files%\GPLGS\ps2pdf14.bat
   • %Program Files%\GPLGS\ps2pdf14.cmd
   • %Program Files%\GPLGS\ps2pdfwr
   • %Program Files%\GPLGS\ps2pdfxx.bat
   • %Program Files%\GPLGS\ps2ps
   • %Program Files%\GPLGS\ps2ps.bat
   • %Program Files%\GPLGS\ps2ps.cmd
   • %Program Files%\GPLGS\ps2ps2
   • %Program Files%\GPLGS\ps2ps2.bat
   • %Program Files%\GPLGS\ps2ps2.cmd
   • %Program Files%\GPLGS\quit.ps
   • %Program Files%\GPLGS\ras1.upp
   • %Program Files%\GPLGS\ras24.upp
   • %Program Files%\GPLGS\ras3.upp
   • %Program Files%\GPLGS\ras32.upp
   • %Program Files%\GPLGS\ras4.upp
   • %Program Files%\GPLGS\ras8m.upp
   • %Program Files%\GPLGS\rinkj-2200-setup
   • %Program Files%\GPLGS\rollconv.ps
   • %Program Files%\GPLGS\showchar.ps
   • %Program Files%\GPLGS\showpage.ps
   • %Program Files%\GPLGS\st640ih.upp
   • %Program Files%\GPLGS\st640ihg.upp
   • %Program Files%\GPLGS\st640p.upp
   • %Program Files%\GPLGS\st640pg.upp
   • %Program Files%\GPLGS\st640pl.upp
   • %Program Files%\GPLGS\st640plg.upp
   • %Program Files%\GPLGS\stc.upp
   • %Program Files%\GPLGS\stc1520h.upp
   • %Program Files%\GPLGS\stc2.upp
   • %Program Files%\GPLGS\stc200_h.upp
   • %Program Files%\GPLGS\stc2s_h.upp
   • %Program Files%\GPLGS\stc2_h.upp
   • %Program Files%\GPLGS\stc300.upp
   • %Program Files%\GPLGS\stc300bl.upp
   • %Program Files%\GPLGS\stc300bm.upp
   • %Program Files%\GPLGS\stc500p.upp
   • %Program Files%\GPLGS\stc500ph.upp
   • %Program Files%\GPLGS\stc600ih.upp
   • %Program Files%\GPLGS\stc600p.upp
   • %Program Files%\GPLGS\stc600pl.upp
   • %Program Files%\GPLGS\stc640p.upp
   • %Program Files%\GPLGS\stc800ih.upp
   • %Program Files%\GPLGS\stc800p.upp
   • %Program Files%\GPLGS\stc800pl.upp
   • %Program Files%\GPLGS\stcany.upp
   • %Program Files%\GPLGS\stcany_h.upp
   • %Program Files%\GPLGS\stcinfo.ps
   • %Program Files%\GPLGS\stcolor.ps
   • %Program Files%\GPLGS\stc_h.upp
   • %Program Files%\GPLGS\stc_l.upp
   • %Program Files%\GPLGS\stocht.ps
   • %Program Files%\GPLGS\traceimg.ps
   • %Program Files%\GPLGS\traceop.ps
   • %Program Files%\GPLGS\type1enc.ps
   • %Program Files%\GPLGS\type1ops.ps
   • %Program Files%\GPLGS\uninfo.ps
   • %Program Files%\GPLGS\unix-lpr.sh
   • %Program Files%\GPLGS\unprot.ps
   • %Program Files%\GPLGS\viewcmyk.ps
   • %Program Files%\GPLGS\viewgif.ps
   • %Program Files%\GPLGS\viewjpeg.ps
   • %Program Files%\GPLGS\viewmiff.ps
   • %Program Files%\GPLGS\viewpbm.ps
   • %Program Files%\GPLGS\viewpcx.ps
   • %Program Files%\GPLGS\viewps2a.ps
   • %Program Files%\GPLGS\viewrgb.ps
   • %Program Files%\GPLGS\wftopfa
   • %Program Files%\GPLGS\wftopfa.ps
   • %Program Files%\GPLGS\winmaps.ps
   • %Program Files%\GPLGS\wmakebat.bat
   • %Program Files%\GPLGS\wrfont.ps
   • %Program Files%\GPLGS\zeroline.ps
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).

To delete malware/grayware/spyware folders:

For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Temp%\is-{5 Random Characters}.tmp\_isetup
   • %User Temp%\is-{5 Random Characters}.tmp
   • %User Temp%\oc_{5 Random Characters}
   • %Program Files%\Acro Software\CutePDF Writer
   • %Program Files%\Acro Software
   • %Common Programs%\CutePDF\PDF Writer
   • %Common Programs%\CutePDF
   • %Program Files%\GPLGS
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %User Temp%\is-{5 Random Characters}.tmp\_isetup
   • %User Temp%\is-{5 Random Characters}.tmp
   • %User Temp%\oc_{5 Random Characters}
   • %Program Files%\Acro Software\CutePDF Writer
   • %Program Files%\Acro Software
   • %Common Programs%\CutePDF\PDF Writer
   • %Common Programs%\CutePDF
   • %Program Files%\GPLGS
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).