ADW_CAMPAU

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Classes>CLSID
3. Still in the left panel, locate and delete the key:
   {1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
5. Still in the left panel, locate and delete the key:
   maucampo
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>maucampo
7. Still in the left panel, locate and delete the key:
   Chrome
8. Again Still in the left panel, locate and delete the key:
   Internet Explorer
9. Again Still in the left panel, locate and delete the key:
   Firefox
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>Eventlog>Application
11. Still in the left panel, locate and delete the key:
    Update maucampo
12. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>maucampo
3. In the right panel, locate and delete the entry:
   is = "def_maucampo"
4. Again In the right panel, locate and delete the entry:
   iid = "def_maucampo"
5. Again In the right panel, locate and delete the entry:
   id = "2014-04-02 23:36:56"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>maucampo>Chrome
7. In the right panel, locate and delete the entry:
   sgc = "true"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>maucampo>Internet Explorer
9. In the right panel, locate and delete the entry:
   sie = "false"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>maucampo>Firefox
11. In the right panel, locate and delete the entry:
    sff = "false"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>Eventlog>Application>Update maucampo
13. In the right panel, locate and delete the entry:
    EventMessageFile = "%Windows%\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll"
14. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
3. In the right panel, locate the registry value:
   Blob = "{random values}"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Blob = "{random values}"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
6. In the right panel, locate the registry value:
   Blob = "{random values}"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Blob = "{random values}"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4C95A9902ABE0777CED18D6ACCC3372D2748381E
9. In the right panel, locate the registry value:
   Blob = "{random values}"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4BA7B9DDD68788E12FF852E1A024204BF286A8F6
12. In the right panel, locate the registry value:
    Blob = "{random values}"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
15. In the right panel, locate the registry value:
    Blob = "{random values}"
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>47AFB915CDA26D82467B97FA42914468726138DD
18. In the right panel, locate the registry value:
    Blob = "{random values}"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4463C531D7CCC1006794612BB656D3BF8257846F
21. In the right panel, locate the registry value:
    Blob = "{random values}"
22. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43F9B110D5BAFD48225231B0D0082B372FEF9A54
24. In the right panel, locate the registry value:
    Blob = "{random values}"
25. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43DDB1FFF3B49B73831407F6BC8B975023D07C50
27. In the right panel, locate the registry value:
    Blob = "{random values}"
28. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
30. In the right panel, locate the registry value:
    Blob = "{random values}"
31. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4072BA31FEC351438480F62E6CB95508461EAB2F
33. In the right panel, locate the registry value:
    Blob = "{random values}"
34. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
36. In the right panel, locate the registry value:
    Blob = "{random values}"
37. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>394FF6850B06BE52E51856CC10E180E882B385CC
39. In the right panel, locate the registry value:
    Blob = "{random values}"
40. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>36863563FD5128C7BEA6F005CFE9B43668086CCE
42. In the right panel, locate the registry value:
    Blob = "{random values}"
43. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
45. In the right panel, locate the registry value:
    Blob = "{random values}"
46. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>2F173F7DE99667AFA57AF80AA2D1B12FAC830338
48. In the right panel, locate the registry value:
    Blob = "{random values}"
49. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>284F55C41A1A7A3F8328D4C262FB376ED6096F24
51. In the right panel, locate the registry value:
    Blob = "{random values}"
52. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>273EE12457FDC4F90C55E82B56167F62F532E547
54. In the right panel, locate the registry value:
    Blob = "{random values}"
55. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
57. In the right panel, locate the registry value:
    Blob = "{random values}"
58. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
60. In the right panel, locate the registry value:
    Blob = "{random values}"
61. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>23E594945195F2414803B4D564D2A3A3F5D88B8C
63. In the right panel, locate the registry value:
    Blob = "{random values}"
64. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>216B2A29E62A00CE820146D8244141B92511B279
66. In the right panel, locate the registry value:
    Blob = "{random values}"
67. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>209900B63D955728140CD13622D8C687A4EB0085
69. In the right panel, locate the registry value:
    Blob = "{random values}"
70. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1F55E8839BAC30728BE7108EDE7B0BB0D3298224
72. In the right panel, locate the registry value:
    Blob = "{random values}"
73. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
75. In the right panel, locate the registry value:
    Blob = "{random values}"
76. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
78. In the right panel, locate the registry value:
    Blob = "{random values}"
79. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>049811056AFE9FD0F5BE01685AACE6A5D1C4454C
81. In the right panel, locate the registry value:
    Blob = "{random values}"
82. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0483ED3399AC3608058722EDBC5E4600E3BEF9D7
84. In the right panel, locate the registry value:
    Blob = "{random values}"
85. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
87. In the right panel, locate the registry value:
    Blob = "{random values}"
88. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0048F8D37B153F6EA2798C323EF4F318A5624A9E
90. In the right panel, locate the registry value:
    Blob = "{random values}"
91. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
93. In the right panel, locate the registry value:
    Blob = "{random values}"
94. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>Eventlog>Application
96. In the right panel, locate the registry value:
    Sources = "{random characters}"
97. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Sources = "{random values}"
98. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsy6.tmp\UserInfo.dll
   • %User Temp%\nsy6.tmp\modern-wizard.bmp
   • %User Temp%\nsy6.tmp\nsDialogs.dll
   • %User Temp%\nsy6.tmp\System.dll
   • %User Temp%\nsy6.tmp\ExecDos.dll
   • %User Temp%\nsy6.tmp\NSISEncrypt.dll
   • %User Temp%\nsy6.tmp\IpConfig.dll
   • %User Temp%\nsy6.tmp\WmiInspector.dll
   • %User Temp%\nsy6.tmp\inetc.dll
   • %Program Files%\maucampo\mj
   • %User Temp%\nsy6.tmp\nsJSON.dll
   • %User Temp%\nsy6.tmp\nsExec.dll
   • %Program Files%\maucampo\tlg
   • %Program Files%\maucampo\ifs
   • %Program Files%\maucampo\updatemaucampo.exe
   • %User Temp%\nsy6.tmp\nsProcess.dll
   • %Program Files%\maucampo\7za.exe
   • %Program Files%\maucampo\maucampoFR.7z
   • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
   • %User Profile%\Content\2BF68F4714092295550497DD56F57004
   • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
   • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
   • %User Temp%\Cab2C.tmp
   • %User Temp%\Tar2E.tmp
   • %User Profile%\MetaData\8DFDF057024880D7A081AFBF6D26B92F
   • %User Profile%\Content\8DFDF057024880D7A081AFBF6D26B92F
   • %User Profile%\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
   • %User Profile%\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
   • %Program Files%\maucampo\updatemaucampo.InstallState
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
   • %User Temp%\nsy6.tmp\ns1B.tmp
   • %User Temp%\nsy6.tmp\ns1E.tmp
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsy6.tmp\UserInfo.dll
   • %User Temp%\nsy6.tmp\modern-wizard.bmp
   • %User Temp%\nsy6.tmp\nsDialogs.dll
   • %User Temp%\nsy6.tmp\System.dll
   • %User Temp%\nsy6.tmp\ExecDos.dll
   • %User Temp%\nsy6.tmp\NSISEncrypt.dll
   • %User Temp%\nsy6.tmp\IpConfig.dll
   • %User Temp%\nsy6.tmp\WmiInspector.dll
   • %User Temp%\nsy6.tmp\inetc.dll
   • %Program Files%\maucampo\mj
   • %User Temp%\nsy6.tmp\nsJSON.dll
   • %User Temp%\nsy6.tmp\nsExec.dll
   • %Program Files%\maucampo\tlg
   • %Program Files%\maucampo\ifs
   • %Program Files%\maucampo\updatemaucampo.exe
   • %User Temp%\nsy6.tmp\nsProcess.dll
   • %Program Files%\maucampo\7za.exe
   • %Program Files%\maucampo\maucampoFR.7z
   • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
   • %User Profile%\Content\2BF68F4714092295550497DD56F57004
   • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
   • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
   • %User Temp%\Cab2C.tmp
   • %User Temp%\Tar2E.tmp
   • %User Profile%\MetaData\8DFDF057024880D7A081AFBF6D26B92F
   • %User Profile%\Content\8DFDF057024880D7A081AFBF6D26B92F
   • %User Profile%\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
   • %User Profile%\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
   • %Program Files%\maucampo\updatemaucampo.InstallState
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
   • %User Temp%\nsy6.tmp\ns1B.tmp
   • %User Temp%\nsy6.tmp\ns1E.tmp
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsy6.tmp
   • %Program Files%\maucampo
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsy6.tmp
   • %Program Files%\maucampo
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache
   • %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content