PUA.Win32.KOAL.AF

To delete the registry value this malware created:

1. Open Registry Editor. To do this:
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}>1.0
3. In the right panel, locate and delete the entry:
   Default = "KoalCspWrapper ActiveX Control module"
4. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}>1.0>FLAGS
5. In the right panel, locate and delete the entry:
   Default = "2"
6. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}>1.0>0>win32
7. In the right panel, locate and delete the entry:
   Default = "%Windows%\system32\KoalCspWrapper.ocx"
8. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}>1.0>HELPDIR
9. In the right panel, locate and delete the entry:
   Default = ""
10. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-1}
11. In the right panel, locate and delete the entry:
    Default = "_DKoalCspWrapper"
12. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-1}>ProxyStubClsid
13. In the right panel, locate and delete the entry:
    Default = "{generated ProxyStub ID}""
14. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-1}>ProxyStubClsid32
15. In the right panel, locate and delete the entry:
    Default = "{generated ProxyStub ID}""
16. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-1}>TypeLib
17. In the right panel, locate and delete the entry:
    Default = "{generated TypeLib ID}""
18. Again In the right panel, locate and delete the entry:
    Version = "1.0"
19. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-2}
20. In the right panel, locate and delete the entry:
    Default = "_DKoalCspWrapperEvents"
21. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-2}>ProxyStubClsid
22. In the right panel, locate and delete the entry:
    Default = "{generated ProxyStub ID}""
23. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-2}>ProxyStubClsid32
24. In the right panel, locate and delete the entry:
    Default = "{generated ProxyStub ID}""
25. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-2}>TypeLib
26. In the right panel, locate and delete the entry:
    Default = "{generated TypeLib ID}""
27. Again In the right panel, locate and delete the entry:
    Version = "1.0"
28. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-1}
29. In the right panel, locate and delete the entry:
    Default = "KoalCspWrapper Property Page"
30. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-1}>InprocServer32
31. In the right panel, locate and delete the entry:
    Default = "%Windows%\system32\KOALCS~1.OCX"
32. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>KoalEAClient.CspWrapper.1
33. In the right panel, locate and delete the entry:
    Default = "KoalCspWrapper Control"
34. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>KoalEAClient.CspWrapper.1>CLSID
35. In the right panel, locate and delete the entry:
    Default = "{generated CLSID ID-2}""
36. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}
37. In the right panel, locate and delete the entry:
    Default = "KoalCspWrapper Control"
38. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>ProgID
39. In the right panel, locate and delete the entry:
    Default = "KoalEAClient.CspWrapper.1"
40. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>InprocServer32
41. In the right panel, locate and delete the entry:
    Default = "%Windows%\system32\KOALCS~1.OCX"
42. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>ToolboxBitmap32
43. In the right panel, locate and delete the entry:
    Default = "%Windows%\system32\KOALCS~1.OCX, 1"
44. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>MiscStatus
45. In the right panel, locate and delete the entry:
    Default = "0"
46. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>MiscStatus>1
47. In the right panel, locate and delete the entry:
    Default = "131473"
48. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>Control
49. In the right panel, locate and delete the entry:
    Default = ""
50. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>TypeLib
51. In the right panel, locate and delete the entry:
    Default = "{generated TypeLib ID}""
52. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>Version
53. In the right panel, locate and delete the entry:
    Default = "1.0"
54. Again In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
55. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Component Categories>{generated Implemented Categories ID-1}
56. In the right panel, locate and delete the entry:
    409 = "Controls safely initializable from persistent data!""
57. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Component Categories>{generated Implemented Categories ID-2}
58. In the right panel, locate and delete the entry:
    409 = "Controls safely scriptable!""
59. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>ROOT>Certificates>b26fa75369d6fd879204d8e67fcc105ef35fcd84
60. In the right panel, locate and delete the entry:
    Blob = "{hex values}"
61. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>CA>Certificates>d2ea461e09eeb661f39dd88f63b2d1b592a7d341
62. In the right panel, locate and delete the entry:
    Blob = "{hex values}"
63. Close Registry Editor.

To delete registry keys this malware/grayware created:

1. Open Registry Editor. To do this:
   » For Windows 7 and Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-1}
3. Still in the left panel, locate and delete the key:
   (null)
4. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-1}>InprocServer32
5. Still in the left panel, locate and delete the key:
   (null)
6. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}
7. Still in the left panel, locate and delete the key:
   (null)
8. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>Control
9. Still in the left panel, locate and delete the key:
   (null)
10. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>Implemented Categories
11. Still in the left panel, locate and delete the key:
    (null)
12. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>Implemented Categories>{generated Implemented Categories ID-1}
13. Still in the left panel, locate and delete the key:
    (null)
14. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>Implemented Categories>{generated Implemented Categories ID-2}
15. Still in the left panel, locate and delete the key:
    (null)
16. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>InprocServer32
17. Still in the left panel, locate and delete the key:
    (null)
18. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>MiscStatus
19. Still in the left panel, locate and delete the key:
    (null)
20. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>MiscStatus>1
21. Still in the left panel, locate and delete the key:
    (null)
22. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>ProgID
23. Still in the left panel, locate and delete the key:
    (null)
24. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>ToolboxBitmap32
25. Still in the left panel, locate and delete the key:
    (null)
26. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>TypeLib
27. Still in the left panel, locate and delete the key:
    (null)
28. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-2}>Version
29. Still in the left panel, locate and delete the key:
    (null)
30. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-3}
31. Still in the left panel, locate and delete the key:
    (null)
32. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-3}>Implemented Categories
33. Still in the left panel, locate and delete the key:
    (null)
34. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-3}>Implemented Categories>{generated Implemented Categories ID-1}
35. Still in the left panel, locate and delete the key:
    (null)
36. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{generated CLSID ID-3}>Implemented Categories>{generated Implemented Categories ID-2}
37. Still in the left panel, locate and delete the key:
    (null)
38. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-1}
39. Still in the left panel, locate and delete the key:
    (null)
40. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-1}>ProxyStubClsid
41. Still in the left panel, locate and delete the key:
    (null)
42. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-1}>ProxyStubClsid32
43. Still in the left panel, locate and delete the key:
    (null)
44. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-1}>TypeLib
45. Still in the left panel, locate and delete the key:
    (null)
46. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-2}
47. Still in the left panel, locate and delete the key:
    (null)
48. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-2}>ProxyStubClsid
49. Still in the left panel, locate and delete the key:
    (null)
50. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-2}>ProxyStubClsid32
51. Still in the left panel, locate and delete the key:
    (null)
52. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{generated Interface ID-2}>TypeLib
53. Still in the left panel, locate and delete the key:
    (null)
54. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>KoalEAClient.CspWrapper.1
55. Still in the left panel, locate and delete the key:
    (null)
56. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>KoalEAClient.CspWrapper.1>CLSID
57. Still in the left panel, locate and delete the key:
    (null)
58. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}
59. Still in the left panel, locate and delete the key:
    (null)
60. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}>1.0
61. Still in the left panel, locate and delete the key:
    (null)
62. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}>1.0>0
63. Still in the left panel, locate and delete the key:
    (null)
64. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}>1.0>0>win32
65. Still in the left panel, locate and delete the key:
    (null)
66. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}>1.0>FLAGS
67. Still in the left panel, locate and delete the key:
    (null)
68. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{generated TypeLib ID}>1.0>HELPDIR
69. Still in the left panel, locate and delete the key:
    (null)
70. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>CA>Certificates>d2ea461e09eeb661f39dd88f63b2d1b592a7d341
71. Still in the left panel, locate and delete the key:
    (null)
72. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>ROOT>Certificates>b26fa75369d6fd879204d8e67fcc105ef35fcd84
73. Still in the left panel, locate and delete the key:
    (null)
74. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
    
   • %Application Data%\configtools.dat
   • %Application Data%\configtools.log
   • %System%\KoalCspWrapper.ocx
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).