TROJ_INJECT2.B

To restart in Safe Mode:

• For Windows 2000 users

1. Restart your computer.
2. Press F8 when you see the Starting Windows bar at the bottom of the screen.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows XP users

1. Restart your computer.
2. Press F8 after the Power-On Self Test (POST) routine is done. If the Windows Advanced Options menu does not appear, try restarting then pressing F8 several times when the POST screen appears.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows Server 2003 users

1. Restart your computer.
2. Press F8 after Windows starts up. If the Windows Advanced Options menu does not appear, try restarting again and pressing F8 several times afterward.
3. On the Windows Advanced Option menu, use the arrow keys to select Safe Mode then press Enter.

• For Windows Vista, Windows 7, and Windows Server 2008 (R2) users

1. Restart your computer.
2. Press F8 after the Power-On Self Test (POST) routine is done. If the Advanced Boot Options menu does not appear, try restarting and then pressing F8 several times after the POST screen is displayed.
3. On the Advanced Boot Options menu, use the arrow keys to select the Safe Mode option, and then press Enter.

• For Windows 8, Windows 8.1, and Windows Server 2012 (R2) users

1. Access the Charms bar by moving your mouse pointer to the upper right corner of the screen.
2. Move your mouse pointer down and click Settings>Change your PC Settings.
3. In the left panel, click General.
4. In the right panel, scroll down to the bottom to find the Advanced startup section, then click the Restart now button and wait for the system to restart.
5. In the Advanced Startup menu, click Troubleshoot>Advanced Options>Startup Settings>Restart and wait for the system to restart.
6. In the Startup Settings menu, press 4 to enable safe mode.

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>software
3. Still in the left panel, locate and delete the key:
   CA1D59C99F141A494CEB72010C176A55
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>software>CA1D59C99F141A494CEB72010C176A55
5. Still in the left panel, locate and delete the key:
   00112455677ABCCE
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>SystemCertificates>CA>Certificates
7. Still in the left panel, locate and delete the key:
   5824CF32C3CC2A47443DB10A33BBE3AC8DE524E1
8. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   ca1d59 = "%System Root%\ca1d59c\ca1d59c.exe"
4. Again In the right panel, locate and delete the entry:
   ca1d59c = "%User Profile%\Application Data\ca1d59c.exe"
5. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>CA1D59C99F141A494CEB72010C176A55
6. In the right panel, locate and delete the entry:
   aa = "{random values}"
7. Again In the right panel, locate and delete the entry:
   1b = "{random characters}"
8. Again In the right panel, locate and delete the entry:
   dc = "{random characters}"
9. Again In the right panel, locate and delete the entry:
   5d = "{random characters}"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>CA1D59C99F141A494CEB72010C176A55>00112455677ABCCE
11. In the right panel, locate and delete the entry:
    %User Profile%\Internet Explorer\brndlog.bak = "68adfd"
12. Again In the right panel, locate and delete the entry:
    %User Profile%\Internet Explorer\brndlog.txt = "68adfd"
13. Again In the right panel, locate and delete the entry:
    %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD = "68adfd"
14. Again In the right panel, locate and delete the entry:
    %User Profile%\Templates\excel.xls = "68adfd"
15. Again In the right panel, locate and delete the entry:
    %User Profile%\Templates\excel4.xls = "68adfd"
16. Again In the right panel, locate and delete the entry:
    %User Profile%\Templates\powerpnt.ppt = "68adfd"
17. Again In the right panel, locate and delete the entry:
    %User Profile%\Templates\quattro.wb2 = "68adfd"
18. Again In the right panel, locate and delete the entry:
    %User Profile%\Templates\sndrec.wav = "68adfd"
19. Again In the right panel, locate and delete the entry:
    %User Profile%\Templates\winword.doc = "68adfd"
20. Again In the right panel, locate and delete the entry:
    %User Profile%\Templates\winword2.doc = "68adfd"
21. Again In the right panel, locate and delete the entry:
    %User Profile%\Templates\wordpfct.wpd = "68adfd"
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>SystemCertificates>CA>Certificates>5824CF32C3CC2A47443DB10A33BBE3AC8DE524E1
23. In the right panel, locate and delete the entry:
    Blob = "{random values}"
24. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista, 7, and Server 2008 (R2):
     Click the Start button, type REGEDIT in the Search input field then press Enter.
   • On Windows 8, 8.1, and Server 2012 (R2):
     Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>SystemRestore
3. In the right panel, locate the registry value:
   DisableSR = "1"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>2F173F7DE99667AFA57AF80AA2D1B12FAC830338
5. In the right panel, locate the registry value:
   Blob = "{random values}"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Blob = "{random values}"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
8. In the right panel, locate the registry value:
   Blob = "{random values}"
9. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Blob = "{random values}"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
11. In the right panel, locate the registry value:
    Blob = "{random values}"
12. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4C95A9902ABE0777CED18D6ACCC3372D2748381E
14. In the right panel, locate the registry value:
    Blob = "{random values}"
15. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4BA7B9DDD68788E12FF852E1A024204BF286A8F6
17. In the right panel, locate the registry value:
    Blob = "{random values}"
18. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
20. In the right panel, locate the registry value:
    Blob = "{random values}"
21. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>47AFB915CDA26D82467B97FA42914468726138DD
23. In the right panel, locate the registry value:
    Blob = "{random values}"
24. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4463C531D7CCC1006794612BB656D3BF8257846F
26. In the right panel, locate the registry value:
    Blob = "{random values}"
27. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43F9B110D5BAFD48225231B0D0082B372FEF9A54
29. In the right panel, locate the registry value:
    Blob = "{random values}"
30. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43DDB1FFF3B49B73831407F6BC8B975023D07C50
32. In the right panel, locate the registry value:
    Blob = "{random values}"
33. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
35. In the right panel, locate the registry value:
    Blob = "{random values}"
36. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4072BA31FEC351438480F62E6CB95508461EAB2F
38. In the right panel, locate the registry value:
    Blob = "{random values}"
39. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
41. In the right panel, locate the registry value:
    Blob = "{random values}"
42. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>394FF6850B06BE52E51856CC10E180E882B385CC
44. In the right panel, locate the registry value:
    Blob = "{random values}"
45. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>36863563FD5128C7BEA6F005CFE9B43668086CCE
47. In the right panel, locate the registry value:
    Blob = "{random values}"
48. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
50. In the right panel, locate the registry value:
    Blob = "{random values}"
51. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>CA>Certificates>E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C
53. In the right panel, locate the registry value:
    Blob = "{random values}"
54. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>284F55C41A1A7A3F8328D4C262FB376ED6096F24
56. In the right panel, locate the registry value:
    Blob = "{random values}"
57. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>273EE12457FDC4F90C55E82B56167F62F532E547
59. In the right panel, locate the registry value:
    Blob = "{random values}"
60. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
62. In the right panel, locate the registry value:
    Blob = "{random values}"
63. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
65. In the right panel, locate the registry value:
    Blob = "{random values}"
66. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>23E594945195F2414803B4D564D2A3A3F5D88B8C
68. In the right panel, locate the registry value:
    Blob = "{random values}"
69. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>216B2A29E62A00CE820146D8244141B92511B279
71. In the right panel, locate the registry value:
    Blob = "{random values}"
72. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>209900B63D955728140CD13622D8C687A4EB0085
74. In the right panel, locate the registry value:
    Blob = "{random values}"
75. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1F55E8839BAC30728BE7108EDE7B0BB0D3298224
77. In the right panel, locate the registry value:
    Blob = "{random values}"
78. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
80. In the right panel, locate the registry value:
    Blob = "{random values}"
81. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
83. In the right panel, locate the registry value:
    Blob = "{random values}"
84. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>049811056AFE9FD0F5BE01685AACE6A5D1C4454C
86. In the right panel, locate the registry value:
    Blob = "{random values}"
87. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0483ED3399AC3608058722EDBC5E4600E3BEF9D7
89. In the right panel, locate the registry value:
    Blob = "{random values}"
90. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
92. In the right panel, locate the registry value:
    Blob = "{random values}"
93. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0048F8D37B153F6EA2798C323EF4F318A5624A9E
95. In the right panel, locate the registry value:
    Blob = "{random values}"
96. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
97. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %System Root%\ca1d59c\ca1d59c.exe
   • %User Profile%\Application Data\ca1d59c.exe
   • %User Startup%\ca1d59c.exe
   • A:\DECRYPT_INSTRUCTION.TXT
   • A:\DECRYPT_INSTRUCTION.HTML
   • A:\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Internet Explorer\brndlog.bak.bu5
   • %User Profile%\Internet Explorer\brndlog.bak
   • %User Profile%\Internet Explorer\brndlog.txt.zl2
   • %User Profile%\Internet Explorer\brndlog.txt
   • %User Profile%\Internet Explorer\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Internet Explorer\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Internet Explorer\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Microsoft\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Microsoft\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Microsoft\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Application Data\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Application Data\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Application Data\DECRYPT_INSTRUCTION.URL
   • %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD.e7s
   • %Application Data%\Microsoft\Windows Media\9.0\DECRYPT_INSTRUCTION.TXT
   • %Application Data%\Microsoft\Windows Media\9.0\DECRYPT_INSTRUCTION.HTML
   • %Application Data%\Microsoft\Windows Media\9.0\DECRYPT_INSTRUCTION.URL
   • %Application Data%\Microsoft\Windows Media\DECRYPT_INSTRUCTION.TXT
   • %Application Data%\Microsoft\Windows Media\DECRYPT_INSTRUCTION.HTML
   • %Application Data%\Microsoft\Windows Media\DECRYPT_INSTRUCTION.URL
   • %Application Data%\Microsoft\DECRYPT_INSTRUCTION.TXT
   • %Application Data%\Microsoft\DECRYPT_INSTRUCTION.HTML
   • %Application Data%\Microsoft\DECRYPT_INSTRUCTION.URL
   • %Application Data%\DECRYPT_INSTRUCTION.TXT
   • %Application Data%\DECRYPT_INSTRUCTION.HTML
   • %Application Data%\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Local Settings\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Local Settings\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Local Settings\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Templates\excel.xls.6dr
   • %User Profile%\Templates\excel4.xls.753
   • %User Profile%\Templates\powerpnt.ppt.l1l
   • %User Profile%\Templates\quattro.wb2.b5g
   • %User Profile%\Templates\sndrec.wav.75g
   • %User Profile%\Templates\winword.doc.7ni
   • %User Profile%\Templates\winword2.doc.zp0
   • %User Profile%\Templates\wordpfct.wpd.zn9
   • %User Profile%\Templates\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Templates\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Templates\DECRYPT_INSTRUCTION.URL
   • %User Profile%\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Internet Explorer\brndlog.bak.jy6
   • %User Profile%\Internet Explorer\brndlog.txt.3n6
   • %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD.il3
   • %User Profile%\Templates\excel.xls.56t
   • %User Profile%\Templates\excel4.xls.h9z
   • %User Profile%\Templates\powerpnt.ppt.5az
   • %User Profile%\Templates\quattro.wb2.c8u
   • %User Profile%\Templates\sndrec.wav.p3g
   • %User Profile%\Templates\winword.doc.4jx
   • %User Profile%\Templates\winword2.doc.5cu
   • %User Profile%\Templates\wordpfct.wpd.h65
   • %System Root%\Documents and Settings\DECRYPT_INSTRUCTION.TXT
   • %System Root%\Documents and Settings\DECRYPT_INSTRUCTION.HTML
   • %System Root%\Documents and Settings\DECRYPT_INSTRUCTION.URL
   • %System Root%\DECRYPT_INSTRUCTION.TXT
   • %System Root%\DECRYPT_INSTRUCTION.HTML
   • %System Root%\DECRYPT_INSTRUCTION.URL
   • %Desktop%\DECRYPT_INSTRUCTION.TXT
   • %Desktop%\DECRYPT_INSTRUCTION.HTML
   • %Desktop%\DECRYPT_INSTRUCTION.URL
   • %User Startup%\DECRYPT_INSTRUCTION.TXT
   • %User Startup%\DECRYPT_INSTRUCTION.HTML
   • %User Startup%\DECRYPT_INSTRUCTION.URL
   • %User Profile%\MetaData\0A873D20E943287602D5D327C5CA3D2F
   • %User Profile%\Content\0A873D20E943287602D5D327C5CA3D2F
   • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
   • %User Profile%\Content\2BF68F4714092295550497DD56F57004
   • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
   • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
   • %User Temp%\Cab87.tmp
   • %User Temp%\Tar89.tmp
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2003 (R2), Windows 8, Windows 8.1, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 (R2) users, right-click on the lower left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System Root%\ca1d59c\ca1d59c.exe
   • %User Profile%\Application Data\ca1d59c.exe
   • %User Startup%\ca1d59c.exe
   • A:\DECRYPT_INSTRUCTION.TXT
   • A:\DECRYPT_INSTRUCTION.HTML
   • A:\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Internet Explorer\brndlog.bak.bu5
   • %User Profile%\Internet Explorer\brndlog.bak
   • %User Profile%\Internet Explorer\brndlog.txt.zl2
   • %User Profile%\Internet Explorer\brndlog.txt
   • %User Profile%\Internet Explorer\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Internet Explorer\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Internet Explorer\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Microsoft\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Microsoft\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Microsoft\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Application Data\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Application Data\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Application Data\DECRYPT_INSTRUCTION.URL
   • %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD.e7s
   • %Application Data%\Microsoft\Windows Media\9.0\DECRYPT_INSTRUCTION.TXT
   • %Application Data%\Microsoft\Windows Media\9.0\DECRYPT_INSTRUCTION.HTML
   • %Application Data%\Microsoft\Windows Media\9.0\DECRYPT_INSTRUCTION.URL
   • %Application Data%\Microsoft\Windows Media\DECRYPT_INSTRUCTION.TXT
   • %Application Data%\Microsoft\Windows Media\DECRYPT_INSTRUCTION.HTML
   • %Application Data%\Microsoft\Windows Media\DECRYPT_INSTRUCTION.URL
   • %Application Data%\Microsoft\DECRYPT_INSTRUCTION.TXT
   • %Application Data%\Microsoft\DECRYPT_INSTRUCTION.HTML
   • %Application Data%\Microsoft\DECRYPT_INSTRUCTION.URL
   • %Application Data%\DECRYPT_INSTRUCTION.TXT
   • %Application Data%\DECRYPT_INSTRUCTION.HTML
   • %Application Data%\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Local Settings\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Local Settings\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Local Settings\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Templates\excel.xls.6dr
   • %User Profile%\Templates\excel4.xls.753
   • %User Profile%\Templates\powerpnt.ppt.l1l
   • %User Profile%\Templates\quattro.wb2.b5g
   • %User Profile%\Templates\sndrec.wav.75g
   • %User Profile%\Templates\winword.doc.7ni
   • %User Profile%\Templates\winword2.doc.zp0
   • %User Profile%\Templates\wordpfct.wpd.zn9
   • %User Profile%\Templates\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\Templates\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\Templates\DECRYPT_INSTRUCTION.URL
   • %User Profile%\DECRYPT_INSTRUCTION.TXT
   • %User Profile%\DECRYPT_INSTRUCTION.HTML
   • %User Profile%\DECRYPT_INSTRUCTION.URL
   • %User Profile%\Internet Explorer\brndlog.bak.jy6
   • %User Profile%\Internet Explorer\brndlog.txt.3n6
   • %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD.il3
   • %User Profile%\Templates\excel.xls.56t
   • %User Profile%\Templates\excel4.xls.h9z
   • %User Profile%\Templates\powerpnt.ppt.5az
   • %User Profile%\Templates\quattro.wb2.c8u
   • %User Profile%\Templates\sndrec.wav.p3g
   • %User Profile%\Templates\winword.doc.4jx
   • %User Profile%\Templates\winword2.doc.5cu
   • %User Profile%\Templates\wordpfct.wpd.h65
   • %System Root%\Documents and Settings\DECRYPT_INSTRUCTION.TXT
   • %System Root%\Documents and Settings\DECRYPT_INSTRUCTION.HTML
   • %System Root%\Documents and Settings\DECRYPT_INSTRUCTION.URL
   • %System Root%\DECRYPT_INSTRUCTION.TXT
   • %System Root%\DECRYPT_INSTRUCTION.HTML
   • %System Root%\DECRYPT_INSTRUCTION.URL
   • %Desktop%\DECRYPT_INSTRUCTION.TXT
   • %Desktop%\DECRYPT_INSTRUCTION.HTML
   • %Desktop%\DECRYPT_INSTRUCTION.URL
   • %User Startup%\DECRYPT_INSTRUCTION.TXT
   • %User Startup%\DECRYPT_INSTRUCTION.HTML
   • %User Startup%\DECRYPT_INSTRUCTION.URL
   • %User Profile%\MetaData\0A873D20E943287602D5D327C5CA3D2F
   • %User Profile%\Content\0A873D20E943287602D5D327C5CA3D2F
   • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
   • %User Profile%\Content\2BF68F4714092295550497DD56F57004
   • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
   • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
   • %User Temp%\Cab87.tmp
   • %User Temp%\Tar89.tmp
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the File name* input box, type:
   
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2003 (R2), Windows 8, Windows 8.1, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 (R2) users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.