TROJ_DROPPR.BA

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Softfy
3. Still in the left panel, locate and delete the key:
   PlugName
4. Again Still in the left panel, locate and delete the key:
   Plug
5. Again Still in the left panel, locate and delete the key:
   PlugDown
6. Again Still in the left panel, locate and delete the key:
   WebIni
7. Again Still in the left panel, locate and delete the key:
   LockPage
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon>Notify
9. Still in the left panel, locate and delete the key:
   logondll
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE
11. Still in the left panel, locate and delete the key:
    IETimbar
12. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
13. Still in the left panel, locate and delete the key:
    IETimbar.CRNP.1
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IETimbar.CRNP.1
15. Still in the left panel, locate and delete the key:
    CLSID
16. Again Still in the left panel, locate and delete the key:
    IETimbar.CRNP
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IETimbar.CRNP
18. Still in the left panel, locate and delete the key:
    CLSID
19. Again Still in the left panel, locate and delete the key:
    CurVer
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
21. Still in the left panel, locate and delete the key:
    {1163E531-B58E-4BB9-B877-0906A0A22AEC}
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1163E531-B58E-4BB9-B877-0906A0A22AEC}
23. Still in the left panel, locate and delete the key:
    ProgID
24. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
25. Again Still in the left panel, locate and delete the key:
    Programmable
26. Again Still in the left panel, locate and delete the key:
    InprocServer32
27. Again Still in the left panel, locate and delete the key:
    TypeLib
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
29. Still in the left panel, locate and delete the key:
    {FF5795DC-245C-42C3-A882-7C0AAB708619}
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{FF5795DC-245C-42C3-A882-7C0AAB708619}
31. Still in the left panel, locate and delete the key:
    1.0
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{FF5795DC-245C-42C3-A882-7C0AAB708619}>1.0
33. Still in the left panel, locate and delete the key:
    FLAGS
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{FF5795DC-245C-42C3-A882-7C0AAB708619}>1.0>0
35. Still in the left panel, locate and delete the key:
    win32
36. Again Still in the left panel, locate and delete the key:
    HELPDIR
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
38. Still in the left panel, locate and delete the key:
    {5E7F36B2-E909-4C3F-8A47-A3F70D840720}
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5E7F36B2-E909-4C3F-8A47-A3F70D840720}
40. Still in the left panel, locate and delete the key:
    ProxyStubClsid
41. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
42. Again Still in the left panel, locate and delete the key:
    TypeLib
43. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>*>shellex>ContextMenuHandlers
44. Still in the left panel, locate and delete the key:
    {7138527F-430B-45B0-B164-9AA396644263}
45. Again Still in the left panel, locate and delete the key:
    My.Control.1
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>My.Control.1
47. Still in the left panel, locate and delete the key:
    CLSID
48. Again Still in the left panel, locate and delete the key:
    My.Control
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>My.Control
50. Still in the left panel, locate and delete the key:
    CLSID
51. Again Still in the left panel, locate and delete the key:
    {7138527F-430B-45B0-B164-9AA396644263}
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{7138527F-430B-45B0-B164-9AA396644263}
53. Still in the left panel, locate and delete the key:
    ProgID
54. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
55. Again Still in the left panel, locate and delete the key:
    InprocServer32
56. Again Still in the left panel, locate and delete the key:
    {34B90EED-B1AB-42A9-BA14-F8825153F575}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{34B90EED-B1AB-42A9-BA14-F8825153F575}
58. Still in the left panel, locate and delete the key:
    1.0
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{34B90EED-B1AB-42A9-BA14-F8825153F575}>1.0
60. Still in the left panel, locate and delete the key:
    FLAGS
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{34B90EED-B1AB-42A9-BA14-F8825153F575}>1.0>0
62. Still in the left panel, locate and delete the key:
    win32
63. Again Still in the left panel, locate and delete the key:
    HELPDIR
64. Again Still in the left panel, locate and delete the key:
    {19E65A85-5FEC-4CC3-8F60-738F1E9F1CD0}
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{19E65A85-5FEC-4CC3-8F60-738F1E9F1CD0}
66. Still in the left panel, locate and delete the key:
    ProxyStubClsid
67. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
68. Again Still in the left panel, locate and delete the key:
    TypeLib
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
70. Still in the left panel, locate and delete the key:
    {6783C0A2-5356-4fcb-91C5-00BEB9113000}
71. Again Still in the left panel, locate and delete the key:
    usnsvc.EXE
72. Again Still in the left panel, locate and delete the key:
    {6783C0A2-5356-4FCB-91C5-00BEB9113000}
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{6783C0A2-5356-4FCB-91C5-00BEB9113000}
74. Still in the left panel, locate and delete the key:
    1.0
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{6783C0A2-5356-4FCB-91C5-00BEB9113000}>1.0
76. Still in the left panel, locate and delete the key:
    FLAGS
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{6783C0A2-5356-4FCB-91C5-00BEB9113000}>1.0>0
78. Still in the left panel, locate and delete the key:
    win32
79. Again Still in the left panel, locate and delete the key:
    HELPDIR
80. Again Still in the left panel, locate and delete the key:
    {01F02BB1-229E-402f-B3E9-B340647417F9}
81. Again Still in the left panel, locate and delete the key:
    {01F02BB1-229E-402F-B3E9-B340647417F9}
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{01F02BB1-229E-402F-B3E9-B340647417F9}
83. Still in the left panel, locate and delete the key:
    1.0
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{01F02BB1-229E-402F-B3E9-B340647417F9}>1.0
85. Still in the left panel, locate and delete the key:
    FLAGS
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{01F02BB1-229E-402F-B3E9-B340647417F9}>1.0>0
87. Still in the left panel, locate and delete the key:
    win32
88. Again Still in the left panel, locate and delete the key:
    HELPDIR
89. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Softfy>PlugName
3. In the right panel, locate and delete the entry:
   LogonName = "fly1057.dll"
4. Again In the right panel, locate and delete the entry:
   LogonMainName = "flymain1805.dll"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Softfy>Plug
6. In the right panel, locate and delete the entry:
   PlugUserName = "fullman"
7. Again In the right panel, locate and delete the entry:
   PlugSoftName = "C2"
8. Again In the right panel, locate and delete the entry:
   PlugSoftVer = "1.0.1"
9. Again In the right panel, locate and delete the entry:
   PlugSendNum = "0"
10. Again In the right panel, locate and delete the entry:
    PlugStat = "0"
11. Again In the right panel, locate and delete the entry:
    PlugUpdate = "1.0.2"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Softfy>PlugDown
13. In the right panel, locate and delete the entry:
    PlugOne = "1.0.0"
14. Again In the right panel, locate and delete the entry:
    PlugTwo = "1.0.0"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Softfy>WebIni
16. In the right panel, locate and delete the entry:
    WebIniVer = "1.0.0"
17. Again In the right panel, locate and delete the entry:
    WebIniSection = "5"
18. Again In the right panel, locate and delete the entry:
    HitProbaby = "0"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Softfy>LockPage
20. In the right panel, locate and delete the entry:
    LockPageNum = "0"
21. Again In the right panel, locate and delete the entry:
    NeedLockPage = "0"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon>Notify>logondll
23. In the right panel, locate and delete the entry:
    DllName = "fly1057.dll"
24. Again In the right panel, locate and delete the entry:
    Asynchronous = "1"
25. Again In the right panel, locate and delete the entry:
    Impersonate = "0"
26. Again In the right panel, locate and delete the entry:
    Startup = "EventStartup"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>IETimbar
28. In the right panel, locate and delete the entry:
    Install_Dir = "%Program Files%\Internet Explorer\IETimbar"
29. Again In the right panel, locate and delete the entry:
    SoftVer = "3.0.0.0"
30. Again In the right panel, locate and delete the entry:
    DataVer = "3.0.0.0"
31. Again In the right panel, locate and delete the entry:
    TM = "0"
32. Again In the right panel, locate and delete the entry:
    AgentID = "-50331499"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{1163E531-B58E-4BB9-B877-0906A0A22AEC}
34. In the right panel, locate and delete the entry:
    NoExplorer = "1"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1163E531-B58E-4BB9-B877-0906A0A22AEC}>InprocServer32
36. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5E7F36B2-E909-4C3F-8A47-A3F70D840720}>TypeLib
38. In the right panel, locate and delete the entry:
    Version = "1.0"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{7138527F-430B-45B0-B164-9AA396644263}>InprocServer32
40. In the right panel, locate and delete the entry:
    ThreadingModel = "both"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{19E65A85-5FEC-4CC3-8F60-738F1E9F1CD0}>TypeLib
42. In the right panel, locate and delete the entry:
    Version = "1.0"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>usnsvc.EXE
44. In the right panel, locate and delete the entry:
    AppID = "{6783C0A2-5356-4fcb-91C5-00BEB9113000}"
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{6783C0A2-5356-4fcb-91C5-00BEB9113000}
46. In the right panel, locate and delete the entry:
    LocalService = "usnsvc"
47. Again In the right panel, locate and delete the entry:
    ServiceParameters = "-Service"
48. Again In the right panel, locate and delete the entry:
    AppID = "{01F02BB1-229E-402f-B3E9-B340647417F9}"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{01F02BB1-229E-402f-B3E9-B340647417F9}
50. In the right panel, locate and delete the entry:
    LocalService = "usnsvc"
51. Again In the right panel, locate and delete the entry:
    ServiceParameters = "-Service"
52. Again In the right panel, locate and delete the entry:
    PlugSendNum = "1"
53. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Search
3. In the right panel, locate the registry value:
   CustomizeSearch = "http://www.{BLOCKED}80.com/1.htm"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   CustomizeSearch = "http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
5. Again In the right panel, locate the registry value:
   SearchAssistant = "http://www.{BLOCKED}80.com/1.htm"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
   SearchAssistant = "http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>BrowseNewProcess
8. In the right panel, locate the registry value:
   BrowseNewProcess = "yes"
9. Right-click on the value name and choose Modify. Change the value data of this entry to:
   BrowseNewProcess = "yes"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>BrowseNewProcess
11. In the right panel, locate the registry value:
    BrowseNewProcess = "yes"
12. Right-click on the value name and choose Modify. Change the value data of this entry to:
    BrowseNewProcess = "yes"
13. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsa2.tmp
   • %User Temp%\small66.exe
   • %User Temp%\svchosts.exe
   • %User Temp%\lqbz82.exe
   • %User Temp%\llly66.exe
   • %User Temp%\paimin6.exe
   • %User Temp%\install_205412.exe
   • %User Temp%\qq2009.exe
   • %User Temp%\ColorPix.exe
   • %System%\flymain.dll
   • %System%\flyplug.dll
   • %System%\fly1057.dll
   • %System%\dllcache\fly1057.dll
   • %System%\flymain1805.dll
   • %System%\dllcache\flymain1805.dll
   • %Windows%\inf\dfg8964.PNF
   • %User Temp%\5.tmp
   • %User Temp%\Messenger\install.exe
   • %User Temp%\Messenger\mwsys.txt
   • %User Temp%\Messenger\nlpsa.txt
   • %User Temp%\Messenger\nvsys.ini
   • %User Temp%\Messenger\setup.exe
   • %User Temp%\Messenger\sysmain.dat
   • %User Temp%\Messenger\sysvc.dat
   • %Program Files%\Internet Explorer\IETimbar\IETimbar.dll
   • %Program Files%\Internet Explorer\IETimbar\cfg.dat
   • %Program Files%\Internet Explorer\IETimbar\vercfg.dat
   • %Program Files%\Internet Explorer\IETimbar\httpf.dat
   • %Program Files%\Internet Explorer\IETimbar\Uninstall.exe
   • %System%\dllcache\http.sys
   • %System%\drivers\http.txt
   • %System%\drivers\nsrrgx.log
   • %User Temp%\nvsvc32.exe
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsa2.tmp
   • %User Temp%\small66.exe
   • %User Temp%\svchosts.exe
   • %User Temp%\lqbz82.exe
   • %User Temp%\llly66.exe
   • %User Temp%\paimin6.exe
   • %User Temp%\install_205412.exe
   • %User Temp%\qq2009.exe
   • %User Temp%\ColorPix.exe
   • %System%\flymain.dll
   • %System%\flyplug.dll
   • %System%\fly1057.dll
   • %System%\dllcache\fly1057.dll
   • %System%\flymain1805.dll
   • %System%\dllcache\flymain1805.dll
   • %Windows%\inf\dfg8964.PNF
   • %User Temp%\5.tmp
   • %User Temp%\Messenger\install.exe
   • %User Temp%\Messenger\mwsys.txt
   • %User Temp%\Messenger\nlpsa.txt
   • %User Temp%\Messenger\nvsys.ini
   • %User Temp%\Messenger\setup.exe
   • %User Temp%\Messenger\sysmain.dat
   • %User Temp%\Messenger\sysvc.dat
   • %Program Files%\Internet Explorer\IETimbar\IETimbar.dll
   • %Program Files%\Internet Explorer\IETimbar\cfg.dat
   • %Program Files%\Internet Explorer\IETimbar\vercfg.dat
   • %Program Files%\Internet Explorer\IETimbar\httpf.dat
   • %Program Files%\Internet Explorer\IETimbar\Uninstall.exe
   • %System%\dllcache\http.sys
   • %System%\drivers\http.txt
   • %System%\drivers\nsrrgx.log
   • %User Temp%\nvsvc32.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\Messenger
   • %Program Files%\Internet Explorer\IETimbar
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\Messenger
   • %Program Files%\Internet Explorer\IETimbar