TROJ_KRYPT.AJ

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Direct3D
3. Still in the left panel, locate and delete the key:
   MostRecentApplication
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Macromedia>FlashPlayer
5. Still in the left panel, locate and delete the key:
   SafeVersions
6. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
7. Still in the left panel, locate and delete the key:
   MacromediaFlashPaper.MacromediaFlashPaper
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MacromediaFlashPaper.MacromediaFlashPaper
9. Still in the left panel, locate and delete the key:
   CLSID
10. Again Still in the left panel, locate and delete the key:
    ShockwaveFlash.ShockwaveFlash.7
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShockwaveFlash.ShockwaveFlash.7
12. Still in the left panel, locate and delete the key:
    CLSID
13. Again Still in the left panel, locate and delete the key:
    ShockwaveFlash.ShockwaveFlash.8
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShockwaveFlash.ShockwaveFlash.8
15. Still in the left panel, locate and delete the key:
    CLSID
16. Again Still in the left panel, locate and delete the key:
    ShockwaveFlash.ShockwaveFlash.9
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShockwaveFlash.ShockwaveFlash.9
18. Still in the left panel, locate and delete the key:
    CLSID
19. Again Still in the left panel, locate and delete the key:
    ShockwaveFlash.ShockwaveFlash.10
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShockwaveFlash.ShockwaveFlash.10
21. Still in the left panel, locate and delete the key:
    CLSID
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D27CDB6E-AE6D-11cf-96B8-444553540000}
23. Still in the left panel, locate and delete the key:
    Programmable
24. Again Still in the left panel, locate and delete the key:
    Control
25. Again Still in the left panel, locate and delete the key:
    EnableFullPage
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D27CDB6E-AE6D-11cf-96B8-444553540000}>EnableFullPage
27. Still in the left panel, locate and delete the key:
    .spl
28. Again Still in the left panel, locate and delete the key:
    .swf
29. Again Still in the left panel, locate and delete the key:
    .mfp
30. Again Still in the left panel, locate and delete the key:
    Implemented Categories
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D27CDB6E-AE6D-11cf-96B8-444553540000}>Implemented Categories
32. Still in the left panel, locate and delete the key:
    {7DD95802-9882-11CF-9FA9-00AA006C42C4}
33. Again Still in the left panel, locate and delete the key:
    {7DD95801-9882-11CF-9FA9-00AA006C42C4}
34. Again Still in the left panel, locate and delete the key:
    {31CAF6E4-D6AA-4090-A050-A5AC8972E9EF}
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D27CDB70-AE6D-11cf-96B8-444553540000}
36. Still in the left panel, locate and delete the key:
    Programmable
37. Again Still in the left panel, locate and delete the key:
    Control
38. Again Still in the left panel, locate and delete the key:
    .mfp
39. Again Still in the left panel, locate and delete the key:
    .sol
40. Again Still in the left panel, locate and delete the key:
    .sor
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>ActiveX Compatibility
42. Still in the left panel, locate and delete the key:
    {D27CDB70-AE6D-11cf-96B8-444553540000}
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
44. Still in the left panel, locate and delete the key:
    {86230738-D762-4C50-A2DE-A753E5B1686F}
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{86230738-D762-4C50-A2DE-A753E5B1686F}
46. Still in the left panel, locate and delete the key:
    ProxyStubClsid
47. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
48. Again Still in the left panel, locate and delete the key:
    TypeLib
49. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>MacromediaFlashPaper.MacromediaFlashPaper>shell>open
50. Still in the left panel, locate and delete the key:
    command
51. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>MacromediaFlashPaper.MacromediaFlashPaper
52. Still in the left panel, locate and delete the key:
    DefaultIcon
53. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Direct3D>MostRecentApplication
3. In the right panel, locate and delete the entry:
   Name = "{malware file name}"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Macromedia>FlashPlayer>SafeVersions
5. In the right panel, locate and delete the entry:
   6.0 = "ffffffff"
6. Again In the right panel, locate and delete the entry:
   7.0 = "ffffffff"
7. Again In the right panel, locate and delete the entry:
   8.0 = "ffffffff"
8. Again In the right panel, locate and delete the entry:
   9.0 = "ffffffff"
9. Again In the right panel, locate and delete the entry:
   10.0 = "e61e"
10. Again In the right panel, locate and delete the entry:
    11.0 = "6637"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.mfp
12. In the right panel, locate and delete the entry:
    Content Type = "application/x-shockwave-flash"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.sol
14. In the right panel, locate and delete the entry:
    Content Type = "text/plain"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.sor
16. In the right panel, locate and delete the entry:
    Content Type = "text/plain"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>ActiveX Compatibility>{D27CDB70-AE6D-11cf-96B8-444553540000}
18. In the right panel, locate and delete the entry:
    Compatibility Flags = "1"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{86230738-D762-4C50-A2DE-A753E5B1686F}>TypeLib
20. In the right panel, locate and delete the entry:
    Version = "1.0"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Macromedia>FlashPlayer
22. In the right panel, locate and delete the entry:
    CurrentVersion = "11,1,102,55"
23. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D27CDB6E-AE6D-11cf-96B8-444553540000}>InprocServer32
3. In the right panel, locate the registry value:
   ThreadingModel = "Apartment"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Apartment"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D27CDB70-AE6D-11cf-96B8-444553540000}>InprocServer32
6. In the right panel, locate the registry value:
   ThreadingModel = "Apartment"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Apartment"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.spl
9. In the right panel, locate the registry value:
   Content Type = "application/futuresplash"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Content Type = "application/futuresplash"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.swf
12. In the right panel, locate the registry value:
    Content Type = "application/x-shockwave-flash"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Content Type = "application/x-shockwave-flash"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type>application/futuresplash
15. In the right panel, locate the registry value:
    Extension = ".spl"
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Extension = ".spl"
17. Again In the right panel, locate the registry value:
    CLSID = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"
18. Right-click on the value name and choose Modify. Change the value data of this entry to:
    CLSID = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type>application/x-shockwave-flash
20. In the right panel, locate the registry value:
    Extension = ".swf"
21. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Extension = ".swf"
22. Again In the right panel, locate the registry value:
    CLSID = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"
23. Right-click on the value name and choose Modify. Change the value data of this entry to:
    CLSID = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"
24. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>GDIPlus
25. In the right panel, locate the registry value:
    FontCachePath = "%Application Data%"
26. Right-click on the value name and choose Modify. Change the value data of this entry to:
    FontCachePath = "%User Profile%\Local Settings\Application Data"
27. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Profile%\mm.cfg
   • %User Profile%\FlashPlayerTrust\bb2a64582b3509cd915c634951fe63f1.cfg
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Profile%\mm.cfg
   • %User Profile%\FlashPlayerTrust\bb2a64582b3509cd915c634951fe63f1.cfg
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Profile%\Application Data\Macromedia
   • %User Profile%\Macromedia\Flash Player
   • %User Profile%\Flash Player\Cache
   • %User Profile%\Cache\bb2a64582b3509cd915c634951fe63f1
   • %User Profile%\Flash Player\#Security
   • %User Profile%\#Security\FlashPlayerTrust
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Profile%\Application Data\Macromedia
   • %User Profile%\Macromedia\Flash Player
   • %User Profile%\Flash Player\Cache
   • %User Profile%\Cache\bb2a64582b3509cd915c634951fe63f1
   • %User Profile%\Flash Player\#Security
   • %User Profile%\#Security\FlashPlayerTrust