Ransom_MILICRY.GQF

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista, 7, and Server 2008:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
   • On Windows 8, 8.1, and Server 2012:
     Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.imaadpcm
3. In the right panel, locate the registry value:
   fdwSupport = "1"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   fdwSupport = "1"
5. Again In the right panel, locate the registry value:
   cFormatTags = "2"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
   cFormatTags = "2"
7. Again In the right panel, locate the registry value:
   aFormatTagCache = "{random values}"
8. Right-click on the value name and choose Modify. Change the value data of this entry to:
   aFormatTagCache = "{random values}"
9. Again In the right panel, locate the registry value:
   cFilterTags = "0"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Multimedia>msacm.imaadpcm
11. In the right panel, locate the registry value:
    MaxRTEncodeSetting = "6"
12. Right-click on the value name and choose Modify. Change the value data of this entry to:
    MaxRTEncodeSetting = "6"
13. Again In the right panel, locate the registry value:
    MaxRTDecodeSetting = "6"
14. Right-click on the value name and choose Modify. Change the value data of this entry to:
    MaxRTDecodeSetting = "6"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.msadpcm
16. In the right panel, locate the registry value:
    fdwSupport = "1"
17. Right-click on the value name and choose Modify. Change the value data of this entry to:
    fdwSupport = "1"
18. Again In the right panel, locate the registry value:
    cFormatTags = "2"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    cFormatTags = "2"
20. Again In the right panel, locate the registry value:
    aFormatTagCache = "{random values}"
21. Right-click on the value name and choose Modify. Change the value data of this entry to:
    aFormatTagCache = "{random values}"
22. Again In the right panel, locate the registry value:
    cFilterTags = "0"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.msg711
24. In the right panel, locate the registry value:
    fdwSupport = "1"
25. Right-click on the value name and choose Modify. Change the value data of this entry to:
    fdwSupport = "1"
26. Again In the right panel, locate the registry value:
    cFormatTags = "3"
27. Right-click on the value name and choose Modify. Change the value data of this entry to:
    cFormatTags = "3"
28. Again In the right panel, locate the registry value:
    aFormatTagCache = "{random values}"
29. Right-click on the value name and choose Modify. Change the value data of this entry to:
    aFormatTagCache = "{random values}"
30. Again In the right panel, locate the registry value:
    cFilterTags = "0"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.msgsm610
32. In the right panel, locate the registry value:
    fdwSupport = "1"
33. Right-click on the value name and choose Modify. Change the value data of this entry to:
    fdwSupport = "1"
34. Again In the right panel, locate the registry value:
    cFormatTags = "2"
35. Right-click on the value name and choose Modify. Change the value data of this entry to:
    cFormatTags = "2"
36. Again In the right panel, locate the registry value:
    aFormatTagCache = "{random values}"
37. Right-click on the value name and choose Modify. Change the value data of this entry to:
    aFormatTagCache = "{random values}"
38. Again In the right panel, locate the registry value:
    cFilterTags = "0"
39. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Multimedia>msacm.msgsm610
40. In the right panel, locate the registry value:
    MaxRTEncodeSetting = "4"
41. Right-click on the value name and choose Modify. Change the value data of this entry to:
    MaxRTEncodeSetting = "4"
42. Again In the right panel, locate the registry value:
    MaxRTDecodeSetting = "4"
43. Right-click on the value name and choose Modify. Change the value data of this entry to:
    MaxRTDecodeSetting = "4"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.trspch
45. In the right panel, locate the registry value:
    fdwSupport = "1"
46. Right-click on the value name and choose Modify. Change the value data of this entry to:
    fdwSupport = "1"
47. Again In the right panel, locate the registry value:
    cFormatTags = "2"
48. Right-click on the value name and choose Modify. Change the value data of this entry to:
    cFormatTags = "2"
49. Again In the right panel, locate the registry value:
    aFormatTagCache = "{random values}"
50. Right-click on the value name and choose Modify. Change the value data of this entry to:
    aFormatTagCache = "{random values}"
51. Again In the right panel, locate the registry value:
    cFilterTags = "0"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.msg723
53. In the right panel, locate the registry value:
    fdwSupport = "1"
54. Right-click on the value name and choose Modify. Change the value data of this entry to:
    fdwSupport = "1"
55. Again In the right panel, locate the registry value:
    cFormatTags = "2"
56. Right-click on the value name and choose Modify. Change the value data of this entry to:
    cFormatTags = "2"
57. Again In the right panel, locate the registry value:
    aFormatTagCache = "{random values}"
58. Right-click on the value name and choose Modify. Change the value data of this entry to:
    aFormatTagCache = "{random values}"
59. Again In the right panel, locate the registry value:
    cFilterTags = "0"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.msaudio1
61. In the right panel, locate the registry value:
    fdwSupport = "1"
62. Right-click on the value name and choose Modify. Change the value data of this entry to:
    fdwSupport = "1"
63. Again In the right panel, locate the registry value:
    cFormatTags = "3"
64. Right-click on the value name and choose Modify. Change the value data of this entry to:
    cFormatTags = "3"
65. Again In the right panel, locate the registry value:
    aFormatTagCache = "{random values}"
66. Right-click on the value name and choose Modify. Change the value data of this entry to:
    aFormatTagCache = "{random values}"
67. Again In the right panel, locate the registry value:
    cFilterTags = "0"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.sl_anet
69. In the right panel, locate the registry value:
    fdwSupport = "1"
70. Right-click on the value name and choose Modify. Change the value data of this entry to:
    fdwSupport = "1"
71. Again In the right panel, locate the registry value:
    cFormatTags = "2"
72. Right-click on the value name and choose Modify. Change the value data of this entry to:
    cFormatTags = "2"
73. Again In the right panel, locate the registry value:
    aFormatTagCache = "{random values}"
74. Right-click on the value name and choose Modify. Change the value data of this entry to:
    aFormatTagCache = "{random values}"
75. Again In the right panel, locate the registry value:
    cFilterTags = "0"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.iac2
77. In the right panel, locate the registry value:
    fdwSupport = "1"
78. Right-click on the value name and choose Modify. Change the value data of this entry to:
    fdwSupport = "1"
79. Again In the right panel, locate the registry value:
    cFormatTags = "2"
80. Right-click on the value name and choose Modify. Change the value data of this entry to:
    cFormatTags = "2"
81. Again In the right panel, locate the registry value:
    aFormatTagCache = "{random values}"
82. Right-click on the value name and choose Modify. Change the value data of this entry to:
    aFormatTagCache = "{random values}"
83. Again In the right panel, locate the registry value:
    cFilterTags = "0"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>AudioCompressionManager>DriverCache>msacm.l3acm
85. In the right panel, locate the registry value:
    fdwSupport = "1"
86. Right-click on the value name and choose Modify. Change the value data of this entry to:
    fdwSupport = "1"
87. Again In the right panel, locate the registry value:
    cFormatTags = "2"
88. Right-click on the value name and choose Modify. Change the value data of this entry to:
    cFormatTags = "2"
89. Again In the right panel, locate the registry value:
    aFormatTagCache = "{random values}"
90. Right-click on the value name and choose Modify. Change the value data of this entry to:
    aFormatTagCache = "{random values}"
91. Again In the right panel, locate the registry value:
    cFilterTags = "0"
92. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %User Profile%\Application Data\OYcpeznp.tmp
   • %User Profile%\Application Data\GICD35lK.exe
   • %User Startup%\dnxnxx6U.lnk
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Profile%\Application Data\OYcpeznp.tmp
   • %User Profile%\Application Data\GICD35lK.exe
   • %User Startup%\dnxnxx6U.lnk
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.