TROJ_TACMENG.USR

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
    
   • %All Users Profile%\Application Data\Microsoft\Windows
   • %All Users Profile%\Application Data\Microsoft\Windows\Burn
   • %All Users Profile%\Application Data\Microsoft\Windows\LiveUpdata_Mem
   • %All Users Profile%\Application Data\Microsoft\Windows\Burn\{Random}
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
    
   • %All Users Profile%\Application Data\Microsoft\Windows
   • %All Users Profile%\Application Data\Microsoft\Windows\Burn
   • %All Users Profile%\Application Data\Microsoft\Windows\LiveUpdata_Mem
   • %All Users Profile%\Application Data\Microsoft\Windows\Burn\{Random}

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the left panel, click All Files.
3. In the Named input box, type the following:
   
   • %All Users Profile%\Application Data\Microsoft\Windows\Burn\{Random Filename 1}.dll
   • %All Users Profile%\Application Data\Microsoft\Windows\LiveUpdata_Mem\{Random Filename 2}.dll
   • %All Users Profile%\Application Data\Microsoft\Windows\LiveUpdata_Mem\{Random Filename 3}.dll
4. In the Look In drop-down list, select My Computer then press Enter.
5. Once located, select the file then press SHIFT+DELETE to delete it.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type the following:
   
   • %All Users Profile%\Application Data\Microsoft\Windows\Burn\{Random Filename 1}.dll
   • %All Users Profile%\Application Data\Microsoft\Windows\LiveUpdata_Mem\{Random Filename 2}.dll
   • %All Users Profile%\Application Data\Microsoft\Windows\LiveUpdata_Mem\{Random Filename 3}.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete the registry value this malware created:

1. Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies>Explorer>run
3. In the right panel, locate and delete the entry:
   {Random} = "%System%\rundll32.exe %All Users Profile%\Application Data\Microsoft\Windows\Burn\{Random} ServiceMain"
4. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows Media
5. In the right panel, locate and delete the entry:
   XC = {Random Strings}
6. Close Registry Editor.