TROJ_DROPPER.EJQF

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
3. Still in the left panel, locate and delete the key:
   {F6136F5A-4C58-40C7-8DFC-945F5570CB79}
4. Again Still in the left panel, locate and delete the key:
   ad.DLL
5. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
6. Still in the left panel, locate and delete the key:
   ad.h.1
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ad.h.1
8. Still in the left panel, locate and delete the key:
   CLSID
9. Again Still in the left panel, locate and delete the key:
   ad.h
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ad.h
11. Still in the left panel, locate and delete the key:
    CLSID
12. Again Still in the left panel, locate and delete the key:
    CurVer
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
14. Still in the left panel, locate and delete the key:
    {73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}
16. Still in the left panel, locate and delete the key:
    ProgID
17. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
18. Again Still in the left panel, locate and delete the key:
    Programmable
19. Again Still in the left panel, locate and delete the key:
    InprocServer32
20. Again Still in the left panel, locate and delete the key:
    TypeLib
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
22. Still in the left panel, locate and delete the key:
    {5A0063A5-F6E9-4947-9D1C-9300CE1BB342}
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}
24. Still in the left panel, locate and delete the key:
    1.0
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}>1.0
26. Still in the left panel, locate and delete the key:
    FLAGS
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}>1.0>0
28. Still in the left panel, locate and delete the key:
    win32
29. Again Still in the left panel, locate and delete the key:
    HELPDIR
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
31. Still in the left panel, locate and delete the key:
    {78D814F1-9774-4F37-B7F9-CD8F88558B53}
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{78D814F1-9774-4F37-B7F9-CD8F88558B53}
33. Still in the left panel, locate and delete the key:
    ProxyStubClsid
34. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
35. Again Still in the left panel, locate and delete the key:
    TypeLib
36. Again Still in the left panel, locate and delete the key:
    {DD0AD1D0-6C36-4894-B38E-9E5D3392114D}
37. Again Still in the left panel, locate and delete the key:
    iconhandle.DLL
38. Again Still in the left panel, locate and delete the key:
    iconhandle.seticon.1
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>iconhandle.seticon.1
40. Still in the left panel, locate and delete the key:
    CLSID
41. Again Still in the left panel, locate and delete the key:
    iconhandle.seticon
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>iconhandle.seticon
43. Still in the left panel, locate and delete the key:
    CLSID
44. Again Still in the left panel, locate and delete the key:
    CurVer
45. Again Still in the left panel, locate and delete the key:
    {AEFA7E78-CF7E-4550-829F-2C786A0070BF}
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AEFA7E78-CF7E-4550-829F-2C786A0070BF}
47. Still in the left panel, locate and delete the key:
    ProgID
48. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
49. Again Still in the left panel, locate and delete the key:
    Programmable
50. Again Still in the left panel, locate and delete the key:
    InprocServer32
51. Again Still in the left panel, locate and delete the key:
    TypeLib
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>txtfile
53. Still in the left panel, locate and delete the key:
    shellEx
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>txtfile>shellEx
55. Still in the left panel, locate and delete the key:
    IconHandler
56. Again Still in the left panel, locate and delete the key:
    {581F1707-4AD0-4B7B-AD6E-057DB8F686F3}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}
58. Still in the left panel, locate and delete the key:
    1.0
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}>1.0
60. Still in the left panel, locate and delete the key:
    FLAGS
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}>1.0>0
62. Still in the left panel, locate and delete the key:
    win32
63. Again Still in the left panel, locate and delete the key:
    HELPDIR
64. Again Still in the left panel, locate and delete the key:
    {72397142-9352-4A45-99AD-2EF143072AC0}
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{72397142-9352-4A45-99AD-2EF143072AC0}
66. Still in the left panel, locate and delete the key:
    ProxyStubClsid
67. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
68. Again Still in the left panel, locate and delete the key:
    TypeLib
69. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>ad.DLL
3. In the right panel, locate and delete the entry:
   AppID = "{F6136F5A-4C58-40C7-8DFC-945F5570CB79}"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}>InprocServer32
5. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{78D814F1-9774-4F37-B7F9-CD8F88558B53}>TypeLib
7. In the right panel, locate and delete the entry:
   Version = "1.0"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>iconhandle.DLL
9. In the right panel, locate and delete the entry:
   AppID = "{DD0AD1D0-6C36-4894-B38E-9E5D3392114D}"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AEFA7E78-CF7E-4550-829F-2C786A0070BF}>InprocServer32
11. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{72397142-9352-4A45-99AD-2EF143072AC0}>TypeLib
13. In the right panel, locate and delete the entry:
    Version = "1.0"
14. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %System%\webad.dll
   • %System%\iconhandle.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System%\webad.dll
   • %System%\iconhandle.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.