TROJ_DLDR.TYU

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>ClientState
3. Still in the left panel, locate and delete the key:
   {8A69D345-D564-463C-AFF1-A69D9E530F96}
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Google
5. Still in the left panel, locate and delete the key:
   Update
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Group Policy Objects
7. Still in the left panel, locate and delete the key:
   {5317446A-1D6E-4C2D-B558-04C976618623}User
8. Again Still in the left panel, locate and delete the key:
   {5317446A-1D6E-4C2D-B558-04C976618623}Machine
9. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Group Policy Objects>{5317446A-1D6E-4C2D-B558-04C976618623}Machine>Software>Policies>Google
10. Still in the left panel, locate and delete the key:
    Chrome
11. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software
12. Still in the left panel, locate and delete the key:
    RegisteredApplicationsEx
13. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
14. Still in the left panel, locate and delete the key:
    CostMin.CostMin.2.2
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CostMin.CostMin.2.2
16. Still in the left panel, locate and delete the key:
    CLSID
17. Again Still in the left panel, locate and delete the key:
    CostMin.CostMin
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CostMin.CostMin
19. Still in the left panel, locate and delete the key:
    CLSID
20. Again Still in the left panel, locate and delete the key:
    CurVer
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
22. Still in the left panel, locate and delete the key:
    {6058E170-D64F-9022-A920-FCB72D3579F2}
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6058E170-D64F-9022-A920-FCB72D3579F2}
24. Still in the left panel, locate and delete the key:
    ProgID
25. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
26. Again Still in the left panel, locate and delete the key:
    Programmable
27. Again Still in the left panel, locate and delete the key:
    InprocServer32
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
29. Still in the left panel, locate and delete the key:
    ApprovedExtensionsMigration
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>ApprovedExtensionsMigration
31. Still in the left panel, locate and delete the key:
    {6058E170-D64F-9022-A920-FCB72D3579F2}
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies
33. Still in the left panel, locate and delete the key:
    Ext
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext
35. Still in the left panel, locate and delete the key:
    CLSID
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion
37. Still in the left panel, locate and delete the key:
    Ext
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext
39. Still in the left panel, locate and delete the key:
    PreApproved
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
41. Still in the left panel, locate and delete the key:
    {6058E170-D64F-9022-A920-FCB72D3579F2}
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
43. Still in the left panel, locate and delete the key:
    {E2343056-CC08-46AC-B898-BFC7ACF4E755}
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E2343056-CC08-46AC-B898-BFC7ACF4E755}
45. Still in the left panel, locate and delete the key:
    1.0
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E2343056-CC08-46AC-B898-BFC7ACF4E755}>1.0
47. Still in the left panel, locate and delete the key:
    FLAGS
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E2343056-CC08-46AC-B898-BFC7ACF4E755}>1.0>0
49. Still in the left panel, locate and delete the key:
    win32
50. Again Still in the left panel, locate and delete the key:
    HELPDIR
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
52. Still in the left panel, locate and delete the key:
    {9B41579A-1996-42F9-8F84-7B7786818CEF}
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9B41579A-1996-42F9-8F84-7B7786818CEF}
54. Still in the left panel, locate and delete the key:
    ProxyStubClsid
55. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
56. Again Still in the left panel, locate and delete the key:
    TypeLib
57. Again Still in the left panel, locate and delete the key:
    {7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}
59. Still in the left panel, locate and delete the key:
    ProxyStubClsid
60. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
61. Again Still in the left panel, locate and delete the key:
    TypeLib
62. Again Still in the left panel, locate and delete the key:
    {EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
64. Still in the left panel, locate and delete the key:
    ProxyStubClsid
65. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
66. Again Still in the left panel, locate and delete the key:
    TypeLib
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
68. Still in the left panel, locate and delete the key:
    {2F5F003B-C71B-72E3-42B4-DE51AB079EB2}
69. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}
70. Still in the left panel, locate and delete the key:
    _40030ae4
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}
72. Still in the left panel, locate and delete the key:
    _40030ae4
73. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
74. Still in the left panel, locate and delete the key:
    eae10f9d
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
76. Still in the left panel, locate and delete the key:
    eae10f9d
77. Again Still in the left panel, locate and delete the key:
    00000000
78. Again Still in the left panel, locate and delete the key:
    00000000
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE
80. Still in the left panel, locate and delete the key:
    {77D46E27-0E41-4478-87A6-AABE6FBCF252}
81. Again Still in the left panel, locate and delete the key:
    {5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
82. Again Still in the left panel, locate and delete the key:
    {3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
83. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>ClientState>{8A69D345-D564-463C-AFF1-A69D9E530F96}
3. In the right panel, locate and delete the entry:
   ap = "2.0-dev-multi-chrome"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Google>Update
5. In the right panel, locate and delete the entry:
   UpdateDefault = "0"
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Group Policy Objects>{5317446A-1D6E-4C2D-B558-04C976618623}Machine>Software>Policies>Google>Chrome
7. In the right panel, locate and delete the entry:
   MetricsReportingEnabled = "0"
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>RegisteredApplicationsEx
9. In the right panel, locate and delete the entry:
   38857136b137c510b1f2c765be07b58f = "1"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{6058E170-D64F-9022-A920-FCB72D3579F2}
11. In the right panel, locate and delete the entry:
    NoExplorer = "1"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6058E170-D64F-9022-A920-FCB72D3579F2}>InprocServer32
13. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext>CLSID
15. In the right panel, locate and delete the entry:
    {6058E170-D64F-9022-A920-FCB72D3579F2} = "1"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9B41579A-1996-42F9-8F84-7B7786818CEF}>TypeLib
17. In the right panel, locate and delete the entry:
    Version = "1.0"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}>TypeLib
19. In the right panel, locate and delete the entry:
    Version = "1.0"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}>TypeLib
21. In the right panel, locate and delete the entry:
    Version = "1.0"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}
23. In the right panel, locate and delete the entry:
    UninstallString = "{random characters}"
24. Again In the right panel, locate and delete the entry:
    SilentUninstall = "{random characters}"
25. Again In the right panel, locate and delete the entry:
    DisplayName = "CostMin"
26. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://{BLOCKED}n.info"
27. Again In the right panel, locate and delete the entry:
    URLUpdateInfo = "http://{BLOCKED}n.info"
28. Again In the right panel, locate and delete the entry:
    Publisher = "CostMin"
29. Again In the right panel, locate and delete the entry:
    DisplayVersion = "4.2.0.1600"
30. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
31. Again In the right panel, locate and delete the entry:
    NoModify = "1"
32. Again In the right panel, locate and delete the entry:
    CategoryName = "Apps"
33. Again In the right panel, locate and delete the entry:
    InstallDate = "20140610"
34. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%System%\msiexec.exe"
35. Again In the right panel, locate and delete the entry:
    _In = "20140610"
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
37. In the right panel, locate and delete the entry:
    date = "1402401484"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
39. In the right panel, locate and delete the entry:
    date = "1402401484"
40. Again In the right panel, locate and delete the entry:
    data.0 = "N6Kdf7SOuStdA12345Fcy4Nn264QSfqVjQpuAHjkZ5e8J1c1b"
41. Again In the right panel, locate and delete the entry:
    data.0 = "N6Kdf7SOuStdA12345Fcy4Nn264QSfqVjQpuAHjkZ5e8J1c1b"
42. Again In the right panel, locate and delete the entry:
    data.1 = "jRUlaFa2UoB/t/XZTVH/70y3wTpsSYdkPo/PU6+A3N1BoxXSTUGW"
43. Again In the right panel, locate and delete the entry:
    data.1 = "jRUlaFa2UoB/t/XZTVH/70y3wTpsSYdkPo/PU6+A3N1BoxXSTUGW"
44. Again In the right panel, locate and delete the entry:
    usr.0 = "njy8/vztvqomjlhabc"
45. Again In the right panel, locate and delete the entry:
    usr.0 = "njy8/vztvqomjlhabc"
46. Again In the right panel, locate and delete the entry:
    usr.1 = "CLgPJqomjlhabcdefA"
47. Again In the right panel, locate and delete the entry:
    usr.1 = "CLgPJqomjlhabcdefA"
48. Again In the right panel, locate and delete the entry:
    version = "15761"
49. Again In the right panel, locate and delete the entry:
    uuid = "25fb90de-239821b9-68ad0fd0"
50. Again In the right panel, locate and delete the entry:
    uuid = "25fb90de-239821b9-68ad0fd0"
51. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>eae10f9d
52. In the right panel, locate and delete the entry:
    a2e3b941 = "///%"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>eae10f9d
54. In the right panel, locate and delete the entry:
    a2e3b941 = "///%"
55. Again In the right panel, locate and delete the entry:
    bbf88800 = "///%"
56. Again In the right panel, locate and delete the entry:
    bbf88800 = "///%"
57. Again In the right panel, locate and delete the entry:
    state = "0"
58. Again In the right panel, locate and delete the entry:
    a1dcff5b = "V/////%%"
59. Again In the right panel, locate and delete the entry:
    a1dcff5b = "V/////%%"
60. Again In the right panel, locate and delete the entry:
    340d3099 = "/P////%%"
61. Again In the right panel, locate and delete the entry:
    340d3099 = "/P////%%"
62. Again In the right panel, locate and delete the entry:
    0e93c3f3 = "///%"
63. Again In the right panel, locate and delete the entry:
    0e93c3f3 = "///%"
64. Again In the right panel, locate and delete the entry:
    0c230bcb = "///%"
65. Again In the right panel, locate and delete the entry:
    0c230bcb = "///%"
66. Again In the right panel, locate and delete the entry:
    27ddcf6f = "///%"
67. Again In the right panel, locate and delete the entry:
    27ddcf6f = "///%"
68. Again In the right panel, locate and delete the entry:
    414bc593 = "///%"
69. Again In the right panel, locate and delete the entry:
    414bc593 = "///%"
70. Again In the right panel, locate and delete the entry:
    f0bf0bde = "///%"
71. Again In the right panel, locate and delete the entry:
    f0bf0bde = "///%"
72. Again In the right panel, locate and delete the entry:
    c99a5f5c = "///%"
73. Again In the right panel, locate and delete the entry:
    c99a5f5c = "///%"
74. Again In the right panel, locate and delete the entry:
    72758a5d = "///%"
75. Again In the right panel, locate and delete the entry:
    72758a5d = "///%"
76. Again In the right panel, locate and delete the entry:
    e46c271e = "///%"
77. Again In the right panel, locate and delete the entry:
    e46c271e = "///%"
78. Again In the right panel, locate and delete the entry:
    7f69fa1f = "///%"
79. Again In the right panel, locate and delete the entry:
    7f69fa1f = "///%"
80. Again In the right panel, locate and delete the entry:
    3c09c42b = "///%"
81. Again In the right panel, locate and delete the entry:
    3c09c42b = "///%"
82. Again In the right panel, locate and delete the entry:
    7367429f = "///%"
83. Again In the right panel, locate and delete the entry:
    7367429f = "///%"
84. Again In the right panel, locate and delete the entry:
    0dc3ee96 = "/P////%%"
85. Again In the right panel, locate and delete the entry:
    0dc3ee96 = "/P////%%"
86. Again In the right panel, locate and delete the entry:
    d1abcdb6 = "///%"
87. Again In the right panel, locate and delete the entry:
    d1abcdb6 = "///%"
88. Again In the right panel, locate and delete the entry:
    38583bc3 = "N//e/Ct/Vx/l/C/////%"
89. Again In the right panel, locate and delete the entry:
    38583bc3 = "N//e/Ct/Vx/l/C/////%"
90. Again In the right panel, locate and delete the entry:
    c24899a6 = "MP/f/CF/Mx/l/C/////%"
91. Again In the right panel, locate and delete the entry:
    c24899a6 = "MP/f/CF/Mx/l/C/////%"
92. Again In the right panel, locate and delete the entry:
    f1f24e29 = "Vl/l/C/////%"
93. Again In the right panel, locate and delete the entry:
    f1f24e29 = "Vl/l/C/////%"
94. Again In the right panel, locate and delete the entry:
    c5705860 = "Vx////%%"
95. Again In the right panel, locate and delete the entry:
    c5705860 = "Vx////%%"
96. Again In the right panel, locate and delete the entry:
    a0743acc = "N/////%%"
97. Again In the right panel, locate and delete the entry:
    a0743acc = "N/////%%"
98. Again In the right panel, locate and delete the entry:
    c6c5dd44 = "V/////%%"
99. Again In the right panel, locate and delete the entry:
    c6c5dd44 = "V/////%%"
100. Again In the right panel, locate and delete the entry:
     1520c6f1 = "V/////%%"
101. Again In the right panel, locate and delete the entry:
     1520c6f1 = "V/////%%"
102. Again In the right panel, locate and delete the entry:
     2d71d5ab = "V/////%%"
103. Again In the right panel, locate and delete the entry:
     2d71d5ab = "V/////%%"
104. Again In the right panel, locate and delete the entry:
     8b9e4cbc = "V/////%%"
105. Again In the right panel, locate and delete the entry:
     8b9e4cbc = "V/////%%"
106. Again In the right panel, locate and delete the entry:
     fe94ce1e = "V/////%%"
107. Again In the right panel, locate and delete the entry:
     fe94ce1e = "V/////%%"
108. Again In the right panel, locate and delete the entry:
     587b5709 = "V/////%%"
109. Again In the right panel, locate and delete the entry:
     587b5709 = "V/////%%"
110. Again In the right panel, locate and delete the entry:
     lrts = "0"
111. Again In the right panel, locate and delete the entry:
     lrts = "0"
112. Again In the right panel, locate and delete the entry:
     mode = "f"
113. Again In the right panel, locate and delete the entry:
     mode = "f"
114. Again In the right panel, locate and delete the entry:
     svn = "Supporter"
115. Again In the right panel, locate and delete the entry:
     svi = "0"
116. Again In the right panel, locate and delete the entry:
     svt = "5396f2cd"
117. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>00000000
118. In the right panel, locate and delete the entry:
     370856c7 = "{random characters}"
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>00000000
120. In the right panel, locate and delete the entry:
     370856c7 = "{random characters}"
121. Again In the right panel, locate and delete the entry:
     3efeb33e = "{random characters}"
122. Again In the right panel, locate and delete the entry:
     3efeb33e = "{random characters}"
123. Again In the right panel, locate and delete the entry:
     060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"
124. Again In the right panel, locate and delete the entry:
     060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"
125. Again In the right panel, locate and delete the entry:
     iiid = "1"
126. Again In the right panel, locate and delete the entry:
     iiid = "1"
127. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Windows
128. In the right panel, locate and delete the entry:
     LoadAppInit_DLLs = "1"
129. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>{77D46E27-0E41-4478-87A6-AABE6FBCF252}
130. In the right panel, locate and delete the entry:
     40030ae4 = "%Program Files%\Supporter\Supporter.dll"
131. Again In the right panel, locate and delete the entry:
     dlpath = "%Program Files%\suppor~1\suppor~1.dll"
132. Again In the right panel, locate and delete the entry:
     svpath = "%Program Files%\suppor~1\SupporterSvc.dll"
133. Again In the right panel, locate and delete the entry:
     Install_Dir = "%Program Files%\Supporter"
134. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
135. In the right panel, locate and delete the entry:
     UninstallString = "%System%\RUNDLL32.EXE %Program Files%\SUPPOR~1\SUPPOR~1.DLL,_uninstall /un"
136. Again In the right panel, locate and delete the entry:
     QuietUninstallString = "{random characters}"
137. Again In the right panel, locate and delete the entry:
     NoModify = "1"
138. Again In the right panel, locate and delete the entry:
     NoRepair = "1"
139. Again In the right panel, locate and delete the entry:
     Publisher = "Costmin"
140. Again In the right panel, locate and delete the entry:
     InstallDate = "20140610"
141. Again In the right panel, locate and delete the entry:
     DisplayName = "Supporter 1.80"
142. Again In the right panel, locate and delete the entry:
     n = "1"
143. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
144. In the right panel, locate and delete the entry:
     n = "1"
145. Again In the right panel, locate and delete the entry:
     dbaf3ce3 = "/P////%%"
146. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Windows
3. In the right panel, locate the registry value:
   AppInit_DLLs = "%Program Files%\suppor~1\suppor~1.dll"
4. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\pl33936afc.fyt
   • %User Temp%\294823_.exe
   • %User Temp%\18be6784_.exe
   • %User Temp%/569c1992/u5SOCzDflf.dat
   • %User Temp%/569c1992/u5SOCzDflf.exe
   • %User Temp%/569c1992/9k9XZ.dll
   • %User Temp%/569c1992/yGkLPUs3h.x64.dll
   • %User Temp%/569c1992/yGkLPUs3h.tlb
   • %User Temp%/569c1992/yGkLPUs3h.dll
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/content/bg.js
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/install.rdf
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/chrome.manifest
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/bootstrap.js
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/lsdb.js
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/content.js
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/manifest.json
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/background.html
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/nLPnhVs2zcA.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %System%\GroupPolicy\Machine\Registry.pol
   • %Program Files%\CostMin\yGkLPUs3h.dll
   • %Program Files%\CostMin\yGkLPUs3h.tlb
   • %Program Files%\CostMin\yGkLPUs3h.dat
   • %Program Files%\CostMin\yGkLPUs3h.x64.dll
   • %User Profile%\CostMin\u5SOCzDflf.exe
   • %User Profile%\CostMin\u5SOCzDflf.dat
   • %User Profile%\2635c994ef08bff3\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}
   • %User Temp%\tf00294823.dll
   • %Program Files%\Supporter\Supporter.dll
   • %Program Files%\suppor~1\SupporterSvc.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\pl33936afc.fyt
   • %User Temp%\294823_.exe
   • %User Temp%\18be6784_.exe
   • %User Temp%/569c1992/u5SOCzDflf.dat
   • %User Temp%/569c1992/u5SOCzDflf.exe
   • %User Temp%/569c1992/9k9XZ.dll
   • %User Temp%/569c1992/yGkLPUs3h.x64.dll
   • %User Temp%/569c1992/yGkLPUs3h.tlb
   • %User Temp%/569c1992/yGkLPUs3h.dll
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/content/bg.js
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/install.rdf
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/chrome.manifest
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/bootstrap.js
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/lsdb.js
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/content.js
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/manifest.json
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/background.html
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne/nLPnhVs2zcA.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\background.html
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\content.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\lsdb.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\manifest.json
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2\nLPnhVs2zcA.js
   • %System%\GroupPolicy\Machine\Registry.pol
   • %Program Files%\CostMin\yGkLPUs3h.dll
   • %Program Files%\CostMin\yGkLPUs3h.tlb
   • %Program Files%\CostMin\yGkLPUs3h.dat
   • %Program Files%\CostMin\yGkLPUs3h.x64.dll
   • %User Profile%\CostMin\u5SOCzDflf.exe
   • %User Profile%\CostMin\u5SOCzDflf.dat
   • %User Profile%\2635c994ef08bff3\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}
   • %User Temp%\tf00294823.dll
   • %Program Files%\Supporter\Supporter.dll
   • %Program Files%\suppor~1\SupporterSvc.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%/569c1992
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/content
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne
   • %System Root%\Documents and Settings\Administrator
   • %Application Data%\Google
   • %Application Data%\Google\Chrome
   • %Application Data%\Google\Chrome\User Data
   • %Application Data%\Google\Chrome\User Data\Default
   • %Application Data%\Google\Chrome\User Data\Default\Extensions
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %System Root%\Documents and Settings\ASPNET
   • %System Root%\Documents and Settings\Guest
   • %System Root%\Documents and Settings\HelpAssistant
   • %System Root%\Documents and Settings\SUPPORT_388945a0
   • %Application Data%\Comodo
   • %Application Data%\Comodo\Dragon
   • %Application Data%\Comodo\Dragon\User Data
   • %Application Data%\Comodo\Dragon\User Data\Default
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %Application Data%\Google\Chrome SxS
   • %Application Data%\Google\Chrome SxS\User Data
   • %Application Data%\Google\Chrome SxS\User Data\Default
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %Application Data%\Torch
   • %Application Data%\Torch\User Data
   • %Application Data%\Torch\User Data\Default
   • %Application Data%\Torch\User Data\Default\Extensions
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %Application Data%\Chromatic Browser
   • %Application Data%\Chromatic Browser\User Data
   • %Application Data%\Chromatic Browser\User Data\Default
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %System%\GroupPolicy
   • %System%\GroupPolicy\Machine
   • %System%\GroupPolicy\User
   • %Program Files%\CostMin
   • %User Profile%\AppData
   • %User Profile%\AppData\LocalLow
   • %User Profile%\LocalLow\{6058E170-D64F-9022-A920-FCB72D3579F2}
   • %User Profile%\Application Data\CostMin
   • %User Profile%\Application Data\2635c994ef08bff3
   • %Program Files%\Supporter
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%/569c1992
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net
   • %User Temp%/569c1992/fmhtxfpah@gwvpnldwz.net/content
   • %User Temp%/569c1992/omiohhbpmmmomnmnkjkgplafhnogjkne
   • %System Root%\Documents and Settings\Administrator
   • %Application Data%\Google
   • %Application Data%\Google\Chrome
   • %Application Data%\Google\Chrome\User Data
   • %Application Data%\Google\Chrome\User Data\Default
   • %Application Data%\Google\Chrome\User Data\Default\Extensions
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %System Root%\Documents and Settings\ASPNET
   • %System Root%\Documents and Settings\Guest
   • %System Root%\Documents and Settings\HelpAssistant
   • %System Root%\Documents and Settings\SUPPORT_388945a0
   • %Application Data%\Comodo
   • %Application Data%\Comodo\Dragon
   • %Application Data%\Comodo\Dragon\User Data
   • %Application Data%\Comodo\Dragon\User Data\Default
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %Application Data%\Google\Chrome SxS
   • %Application Data%\Google\Chrome SxS\User Data
   • %Application Data%\Google\Chrome SxS\User Data\Default
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %Application Data%\Torch
   • %Application Data%\Torch\User Data
   • %Application Data%\Torch\User Data\Default
   • %Application Data%\Torch\User Data\Default\Extensions
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Torch\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %Application Data%\Chromatic Browser
   • %Application Data%\Chromatic Browser\User Data
   • %Application Data%\Chromatic Browser\User Data\Default
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\omiohhbpmmmomnmnkjkgplafhnogjkne\2.2
   • %System%\GroupPolicy
   • %System%\GroupPolicy\Machine
   • %System%\GroupPolicy\User
   • %Program Files%\CostMin
   • %User Profile%\AppData
   • %User Profile%\AppData\LocalLow
   • %User Profile%\LocalLow\{6058E170-D64F-9022-A920-FCB72D3579F2}
   • %User Profile%\Application Data\CostMin
   • %User Profile%\Application Data\2635c994ef08bff3
   • %Program Files%\Supporter