TROJ_FAKEAV.JPY

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Tarma Installer>Components
3. Still in the left panel, locate and delete the key:
   {4889CB45-FFEB-486E-8785-D034DAC2ACE6}
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Tarma Installer>Products
5. Still in the left panel, locate and delete the key:
   {361E80BE-388B-4270-BF54-A10C2B756504}
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Classes>CLSID
7. Still in the left panel, locate and delete the key:
   {80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
8. Again Still in the left panel, locate and delete the key:
   {FE9271F2-6EFD-44b0-A826-84C829536E93}
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Ext>PreApproved
10. Still in the left panel, locate and delete the key:
    {DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
12. Still in the left panel, locate and delete the key:
    {CFDAFE39-20CE-451D-BD45-A37452F39CF0}
13. Again Still in the left panel, locate and delete the key:
    YontooIEClient.DLL
14. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
15. Still in the left panel, locate and delete the key:
    YontooIEClient.Api.1
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Api.1
17. Still in the left panel, locate and delete the key:
    CLSID
18. Again Still in the left panel, locate and delete the key:
    YontooIEClient.Api
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Api
20. Still in the left panel, locate and delete the key:
    CLSID
21. Again Still in the left panel, locate and delete the key:
    CurVer
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
23. Still in the left panel, locate and delete the key:
    {DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
25. Still in the left panel, locate and delete the key:
    ProgID
26. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
27. Again Still in the left panel, locate and delete the key:
    Programmable
28. Again Still in the left panel, locate and delete the key:
    InprocServer32
29. Again Still in the left panel, locate and delete the key:
    TypeLib
30. Again Still in the left panel, locate and delete the key:
    YontooIEClient.Layers.1
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Layers.1
32. Still in the left panel, locate and delete the key:
    CLSID
33. Again Still in the left panel, locate and delete the key:
    YontooIEClient.Layers
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Layers
35. Still in the left panel, locate and delete the key:
    CLSID
36. Again Still in the left panel, locate and delete the key:
    CurVer
37. Again Still in the left panel, locate and delete the key:
    {FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
39. Still in the left panel, locate and delete the key:
    ProgID
40. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
41. Again Still in the left panel, locate and delete the key:
    Programmable
42. Again Still in the left panel, locate and delete the key:
    InprocServer32
43. Again Still in the left panel, locate and delete the key:
    TypeLib
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
45. Still in the left panel, locate and delete the key:
    {D372567D-67C1-4B29-B3F0-159B52B3E967}
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D372567D-67C1-4B29-B3F0-159B52B3E967}
47. Still in the left panel, locate and delete the key:
    1.0
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D372567D-67C1-4B29-B3F0-159B52B3E967}>1.0
49. Still in the left panel, locate and delete the key:
    FLAGS
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D372567D-67C1-4B29-B3F0-159B52B3E967}>1.0>0
51. Still in the left panel, locate and delete the key:
    win32
52. Again Still in the left panel, locate and delete the key:
    HELPDIR
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
54. Still in the left panel, locate and delete the key:
    {10DE7085-6A1E-4D41-A7BF-9AF93E351401}
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
56. Still in the left panel, locate and delete the key:
    ProxyStubClsid
57. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
58. Again Still in the left panel, locate and delete the key:
    TypeLib
59. Again Still in the left panel, locate and delete the key:
    {1AD27395-1659-4DFF-A319-2CFA243861A5}
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1AD27395-1659-4DFF-A319-2CFA243861A5}
61. Still in the left panel, locate and delete the key:
    ProxyStubClsid
62. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
63. Again Still in the left panel, locate and delete the key:
    TypeLib
64. Again Still in the left panel, locate and delete the key:
    {10DE7085-6A1E-4D41-A7BF-9AF93E351401}
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
66. Still in the left panel, locate and delete the key:
    InProcServer32
67. Again Still in the left panel, locate and delete the key:
    NumMethods
68. Again Still in the left panel, locate and delete the key:
    NumMethods
69. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Recovery
70. Still in the left panel, locate and delete the key:
    Active
71. Again Still in the left panel, locate and delete the key:
    AdminActive
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software
73. Still in the left panel, locate and delete the key:
    Google
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google
75. Still in the left panel, locate and delete the key:
    Chrome
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google>Chrome
77. Still in the left panel, locate and delete the key:
    Extensions
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google>Chrome>Extensions
79. Still in the left panel, locate and delete the key:
    niapdbllcanepiiimjjndipklodoedlc
80. Again Still in the left panel, locate and delete the key:
    {9D9785E5-3424-40B6-A287-BA143AD53109}
81. Again Still in the left panel, locate and delete the key:
    {1A975F48-2A3C-44FE-A91C-49D3C12ED0BC}
82. Again Still in the left panel, locate and delete the key:
    {B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}
83. Again Still in the left panel, locate and delete the key:
    {9307081B-7444-494C-8CF6-2FA7C0E92BFB}
84. Again Still in the left panel, locate and delete the key:
    {BB1DCBF2-6F69-4FB5-BA9F-0B46B5F93395}
85. Again Still in the left panel, locate and delete the key:
    {8D8654CD-7FBC-4C7E-84E9-371BFA8DB04E}
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
87. Still in the left panel, locate and delete the key:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B}
88. Again Still in the left panel, locate and delete the key:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B}
89. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{4889CB45-FFEB-486E-8785-D034DAC2ACE6}
3. In the right panel, locate and delete the entry:
   {361E80BE-388B-4270-BF54-A10C2B756504} = "1"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Products>{361E80BE-388B-4270-BF54-A10C2B756504}
5. In the right panel, locate and delete the entry:
   TizPath = "{malware path and file name}"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>YontooIEClient.DLL
7. In the right panel, locate and delete the entry:
   AppID = "{CFDAFE39-20CE-451D-BD45-A37452F39CF0}"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}>InprocServer32
9. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}>InprocServer32
11. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
13. In the right panel, locate and delete the entry:
    NoExplorer = "1"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}>TypeLib
15. In the right panel, locate and delete the entry:
    Version = "1.0"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1AD27395-1659-4DFF-A319-2CFA243861A5}>TypeLib
17. In the right panel, locate and delete the entry:
    Version = "1.0"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}>InProcServer32
19. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FE9271F2-6EFD-44b0-A826-84C829536E93}
21. In the right panel, locate and delete the entry:
    defaultEnableAppsList = "twittube,buzzdock,YontooNewOffers"
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
23. In the right panel, locate and delete the entry:
    ApplicationTileImmersiveActivation = "0"
24. Again In the right panel, locate and delete the entry:
    AssociationActivationMode = "2"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{9D9785E5-3424-40B6-A287-BA143AD53109}
26. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{1A975F48-2A3C-44FE-A91C-49D3C12ED0BC}
28. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}
30. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{9307081B-7444-494C-8CF6-2FA7C0E92BFB}
32. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{BB1DCBF2-6F69-4FB5-BA9F-0B46B5F93395}
34. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{8D8654CD-7FBC-4C7E-84E9-371BFA8DB04E}
36. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
38. In the right panel, locate and delete the entry:
    UninstallString = "%User Profile%\{889DF~1\Setup.exe /remove /q0"
39. Again In the right panel, locate and delete the entry:
    QuietUninstallString = "%User Profile%\{889DF~1\Setup.exe /remove /q"
40. Again In the right panel, locate and delete the entry:
    ModifyPath = "%User Profile%\{889DF~1\Setup.exe /q0"
41. Again In the right panel, locate and delete the entry:
    Version = "1a3"
42. Again In the right panel, locate and delete the entry:
    VersionMajor = "1"
43. Again In the right panel, locate and delete the entry:
    VersionMinor = "a"
44. Again In the right panel, locate and delete the entry:
    EstimatedSize = "49"
45. Again In the right panel, locate and delete the entry:
    Language = "49"
46. Again In the right panel, locate and delete the entry:
    TSAware = "1"
47. Again In the right panel, locate and delete the entry:
    TinFolder = "%User Profile%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"
48. Again In the right panel, locate and delete the entry:
    TinVersion = "5021"
49. Again In the right panel, locate and delete the entry:
    InstallDate = "20121108"
50. Again In the right panel, locate and delete the entry:
    InstallLocation = "%Program Files%\Yontoo"
51. Again In the right panel, locate and delete the entry:
    InstallSource = "%User Temp%"
52. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico"
53. Again In the right panel, locate and delete the entry:
    DisplayName = "Yontoo 1.10.03"
54. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.10.03"
55. Again In the right panel, locate and delete the entry:
    Publisher = "Yontoo LLC"
56. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://www.{BLOCKED}o.com"
57. Again In the right panel, locate and delete the entry:
    Contact = "support@yontoo.com"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Products>{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
59. In the right panel, locate and delete the entry:
    TizPath = "%User Temp%\YontooSetup-S.exe"
60. Close Registry Editor.

To restore the registry value this malware/grayware/spyware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Zones>3
3. In the right panel, locate the registry value:
   1609 = "0"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   1609 = "1"
5. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %User Temp%\{malware file name}-0180.exe
   • %User Temp%\6F6C1FCC.dat
   • %User Temp%\6F6C1FCC\_Setup.dll
   • %User Temp%\6F6C1FCC\Setup.ico
   • %User Temp%\6F6C1FCC\x86\regsvr32.exe
   • %User Temp%\6F6C1FCC\x64\regsvr32.exe
   • %User Temp%\YontooSetup-S.exe._tm
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat
   • %User Temp%\YontooSetup-S-07DC.exe
   • %User Temp%\B69CE611.dat
   • %User Temp%\B69CE611\_Setup.dll
   • %User Temp%\B69CE611\Setup.ico
   • %User Temp%\B69CE611\_Setupx.dll
   • %User Temp%\B69CE611\Check.txt.tmp
   • %User Temp%\B69CE611\x86\regsvr32.exe
   • %User Temp%\B69CE611\x64\regsvr32.exe
   • %User Temp%\B69CE611\7za.exe._tm
   • %User Temp%\B69CE611\sqlite3.exe._tm
   • %User Temp%\B69CE611\YontooIEClient.dll._tm
   • %User Temp%\B69CE611\InstallHandler.txt.tmp
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
   • %Program Files%\Yontoo\YontooIEClient.dll
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To delete malware/grayware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\6F6C1FCC
   • %User Profile%\Application Data\Tarma Installer
   • %User Profile%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache
   • %User Temp%\6F6C1FCC\x86
   • %User Temp%\6F6C1FCC\x64
   • %User Temp%\B69CE611
   • %User Profile%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Cache
   • %User Temp%\B69CE611\x86
   • %User Temp%\B69CE611\x64
   • %Program Files%\Yontoo
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat the said steps for all folders listed.