TROJ_VBKRYPT.CD

To restart in Safe Mode:

• For Windows 2000 users

1. Restart your computer.
2. Press F8 when you see the Starting Windows bar at the bottom of the screen.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows XP users

1. Restart your computer.
2. Press F8 after the Power-On Self Test (POST) routine is done. If the Windows Advanced Options menu does not appear, try restarting then pressing F8 several times when the POST screen appears.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows Server 2003 users

1. Restart your computer.
2. Press F8 after Windows starts up. If the Windows Advanced Options menu does not appear, try restarting again and pressing F8 several times afterward.
3. On the Windows Advanced Option menu, use the arrow keys to select Safe Mode then press Enter.

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
3. Still in the left panel, locate and delete the key:
   DownloadManager
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>DownloadManager
5. Still in the left panel, locate and delete the key:
   MCN
6. Again Still in the left panel, locate and delete the key:
   IDMBI
7. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>DownloadManager>IDMBI
8. Still in the left panel, locate and delete the key:
   IEXPLORE
9. Again Still in the left panel, locate and delete the key:
   Firefox
10. Again Still in the left panel, locate and delete the key:
    OPERA
11. Again Still in the left panel, locate and delete the key:
    chrome
12. Again Still in the left panel, locate and delete the key:
    Safari
13. Again Still in the left panel, locate and delete the key:
    NETSCP
14. Again Still in the left panel, locate and delete the key:
    Mozilla
15. Again Still in the left panel, locate and delete the key:
    SpecialKeys
16. Again Still in the left panel, locate and delete the key:
    menuExt
17. Again Still in the left panel, locate and delete the key:
    Passwords
18. Again Still in the left panel, locate and delete the key:
    ListSettings
19. Again Still in the left panel, locate and delete the key:
    FoldersTree
20. Again Still in the left panel, locate and delete the key:
    maxID
21. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree
22. Still in the left panel, locate and delete the key:
    Compressed
23. Again Still in the left panel, locate and delete the key:
    Documents
24. Again Still in the left panel, locate and delete the key:
    Music
25. Again Still in the left panel, locate and delete the key:
    Programs
26. Again Still in the left panel, locate and delete the key:
    Video
27. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
28. Still in the left panel, locate and delete the key:
    IDMan.CIDMLinkTransmitter
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IDMan.CIDMLinkTransmitter
30. Still in the left panel, locate and delete the key:
    CLSID
31. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
32. Still in the left panel, locate and delete the key:
    {AC746233-E9D3-49CD-862F-068F7B7CCCA4}
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AC746233-E9D3-49CD-862F-068F7B7CCCA4}
34. Still in the left panel, locate and delete the key:
    LocalServer32
35. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>CLSID
36. Still in the left panel, locate and delete the key:
    {07999AC3-058B-40BF-984F-69EB1E554CA7}
37. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
38. Still in the left panel, locate and delete the key:
    MenuExt
39. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>MenuExt
40. Still in the left panel, locate and delete the key:
    Download with IDM
41. Again Still in the left panel, locate and delete the key:
    Download all links with IDM
42. Again Still in the left panel, locate and delete the key:
    Download FLV video content with IDM
43. Again Still in the left panel, locate and delete the key:
    Low Rights
44. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Low Rights
45. Still in the left panel, locate and delete the key:
    ElevationPolicy
46. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
47. Still in the left panel, locate and delete the key:
    {E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}
48. Again Still in the left panel, locate and delete the key:
    {1902485B-CE75-42C1-BA2D-57E660793D9A}
49. Again Still in the left panel, locate and delete the key:
    DragDrop
50. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Low Rights>DragDrop
51. Still in the left panel, locate and delete the key:
    {19129CDA-AFC0-4330-99BC-C5A834F89006}
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PROTOCOLS>Name-Space Handler
53. Still in the left panel, locate and delete the key:
    http
54. Again Still in the left panel, locate and delete the key:
    https
55. Again Still in the left panel, locate and delete the key:
    ftp
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer
57. Still in the left panel, locate and delete the key:
    Browser Helper Objects
58. Again Still in the left panel, locate and delete the key:
    Scheduler
59. Again Still in the left panel, locate and delete the key:
    Queue
60. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   IDMan = "%User Temp%\IDMan.exe /onboot"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>IEXPLORE
5. In the right panel, locate and delete the entry:
   name = "Internet Explorer"
6. Again In the right panel, locate and delete the entry:
   int = "1"
7. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>Firefox
8. In the right panel, locate and delete the entry:
   name = "Mozilla firefox"
9. Again In the right panel, locate and delete the entry:
   int = "1"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>OPERA
11. In the right panel, locate and delete the entry:
    name = "Opera"
12. Again In the right panel, locate and delete the entry:
    int = "1"
13. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>chrome
14. In the right panel, locate and delete the entry:
    name = "Google Chrome"
15. Again In the right panel, locate and delete the entry:
    int = "1"
16. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>Safari
17. In the right panel, locate and delete the entry:
    name = "Apple Safari"
18. Again In the right panel, locate and delete the entry:
    int = "1"
19. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>NETSCP
20. In the right panel, locate and delete the entry:
    name = "Netscape 6 and later"
21. Again In the right panel, locate and delete the entry:
    int = "1"
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>Mozilla
23. In the right panel, locate and delete the entry:
    name = "Mozilla"
24. Again In the right panel, locate and delete the entry:
    int = "1"
25. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>SpecialKeys
26. In the right panel, locate and delete the entry:
    UseKeyToPrevent = "1"
27. Again In the right panel, locate and delete the entry:
    UseKeyToForce = "0"
28. Again In the right panel, locate and delete the entry:
    AltP = "1"
29. Again In the right panel, locate and delete the entry:
    ShiftP = "0"
30. Again In the right panel, locate and delete the entry:
    CtrlP = "0"
31. Again In the right panel, locate and delete the entry:
    AltF = "0"
32. Again In the right panel, locate and delete the entry:
    CtrlF = "0"
33. Again In the right panel, locate and delete the entry:
    ShiftF = "0"
34. Again In the right panel, locate and delete the entry:
    InsF = "1"
35. Again In the right panel, locate and delete the entry:
    CheckMouse = "1"
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager
37. In the right panel, locate and delete the entry:
    AppDataIDMFolder = "%User Profile%\Application Data\IDM"
38. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>menuExt
39. In the right panel, locate and delete the entry:
    ffdownl1_str = "Download with IDM"
40. Again In the right panel, locate and delete the entry:
    ffdownlAll_str = "Download all links with IDM"
41. Again In the right panel, locate and delete the entry:
    ffdownlFLV_str = "Download last requested FLV video"
42. Again In the right panel, locate and delete the entry:
    ffdownl10FLV_str = "Choose from 10 last requested FLV videos"
43. Again In the right panel, locate and delete the entry:
    ffdownlppFLV_str = "Download FLV video with IDM"
44. Again In the right panel, locate and delete the entry:
    ffdownlFLVa_str = "Download last requested FLV video with IDM"
45. Again In the right panel, locate and delete the entry:
    ffdownl10FLVa_str = "Download FLV videos with IDM from 10 last requested"
46. Again In the right panel, locate and delete the entry:
    ExceptionServers = "{random characters}"
47. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Compressed
48. In the right panel, locate and delete the entry:
    ID = "7"
49. Again In the right panel, locate and delete the entry:
    mask = "zip rar r0* r1* arj gz sit sitx sea ace bz2 7z"
50. Again In the right panel, locate and delete the entry:
    pathW = "[REG_NONE, size: 148 bytes]"
51. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
52. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Documents
53. In the right panel, locate and delete the entry:
    ID = "5"
54. Again In the right panel, locate and delete the entry:
    mask = "doc pdf ppt pps"
55. Again In the right panel, locate and delete the entry:
    pathW = "[REG_NONE, size: 146 bytes]"
56. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
57. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Music
58. In the right panel, locate and delete the entry:
    ID = "2"
59. Again In the right panel, locate and delete the entry:
    mask = "mp3 wav wma mpa ram ra aac aif m4a"
60. Again In the right panel, locate and delete the entry:
    pathW = "[REG_NONE, size: 138 bytes]"
61. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
62. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Programs
63. In the right panel, locate and delete the entry:
    ID = "1"
64. Again In the right panel, locate and delete the entry:
    mask = "exe msi"
65. Again In the right panel, locate and delete the entry:
    pathW = "[REG_NONE, size: 144 bytes]"
66. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
67. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Video
68. In the right panel, locate and delete the entry:
    ID = "3"
69. Again In the right panel, locate and delete the entry:
    mask = "avi mpg mpe mpeg asf wmv mov qt rm mp4 flv"
70. Again In the right panel, locate and delete the entry:
    pathW = "[REG_NONE, size: 138 bytes]"
71. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
72. Again In the right panel, locate and delete the entry:
    Extensions = "{random characters}"
73. Again In the right panel, locate and delete the entry:
    LocalPathW = "[REG_NONE, size: 128 bytes]"
74. Again In the right panel, locate and delete the entry:
    TempPath = "%User Profile%\Application Data\IDM"
75. Again In the right panel, locate and delete the entry:
    FindApps = "0"
76. Again In the right panel, locate and delete the entry:
    ExePath = "%User Temp%\IDMan.exe"
77. Again In the right panel, locate and delete the entry:
    idmvers = "v5.18b5 Trial"
78. Again In the right panel, locate and delete the entry:
    LastCheck = "03/04/12"
79. Again In the right panel, locate and delete the entry:
    ConnectionType = "0"
80. Again In the right panel, locate and delete the entry:
    ConnectionSpeed = "0"
81. Again In the right panel, locate and delete the entry:
    LaunchOnStart = "1"
82. Again In the right panel, locate and delete the entry:
    RememberLastSave = "1"
83. Again In the right panel, locate and delete the entry:
    MonitorUrlClipboard = "0"
84. Again In the right panel, locate and delete the entry:
    UseHttpProxy = "0"
85. Again In the right panel, locate and delete the entry:
    UseFtpProxy = "0"
86. Again In the right panel, locate and delete the entry:
    FtpPasive = "0"
87. Again In the right panel, locate and delete the entry:
    IntegrateNN = "1"
88. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CLSID>{07999AC3-058B-40BF-984F-69EB1E554CA7}
89. In the right panel, locate and delete the entry:
    Model = "4"
90. Again In the right panel, locate and delete the entry:
    Therad = "1"
91. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>MenuExt>Download with IDM
92. In the right panel, locate and delete the entry:
    contexts = "f3"
93. Again In the right panel, locate and delete the entry:
    iedownl1_str = "Download with IDM"
94. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>MenuExt>Download all links with IDM
95. In the right panel, locate and delete the entry:
    contexts = "f3"
96. Again In the right panel, locate and delete the entry:
    iedownlAll_str = "Download all links with IDM"
97. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>MenuExt>Download FLV video content with IDM
98. In the right panel, locate and delete the entry:
    contexts = "f3"
99. Again In the right panel, locate and delete the entry:
    iedownlFLV_str = "Download FLV video content with IDM"
100. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}
101. In the right panel, locate and delete the entry:
     AppName = "IDMan.exe"
102. Again In the right panel, locate and delete the entry:
     AppPath = "%User Temp%"
103. Again In the right panel, locate and delete the entry:
     Policy = "3"
104. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{1902485B-CE75-42C1-BA2D-57E660793D9A}
105. In the right panel, locate and delete the entry:
     AppName = "IEMonitor.exe"
106. Again In the right panel, locate and delete the entry:
     AppPath = "%User Temp%"
107. Again In the right panel, locate and delete the entry:
     Policy = "3"
108. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Low Rights>DragDrop>{19129CDA-AFC0-4330-99BC-C5A834F89006}
109. In the right panel, locate and delete the entry:
     AppName = "IDMan.exe"
110. Again In the right panel, locate and delete the entry:
     AppPath = "%User Temp%"
111. Again In the right panel, locate and delete the entry:
     Policy = "3"
112. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
113. In the right panel, locate and delete the entry:
     DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
114. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer
115. In the right panel, locate and delete the entry:
     DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
116. Again In the right panel, locate and delete the entry:
     FSSettingsChecked = "1"
117. Again In the right panel, locate and delete the entry:
     AdvancedIntegration = "0"
118. Again In the right panel, locate and delete the entry:
     mzcc_ext_vers = "25f"
119. Again In the right panel, locate and delete the entry:
     intAOFRWE = "1"
120. Again In the right panel, locate and delete the entry:
     IntegrateMIE = "1"
121. Again In the right panel, locate and delete the entry:
     mzcc_vers = "ca5a"
122. Again In the right panel, locate and delete the entry:
     TrayIcon = "1"
123. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %User Temp%\IDMan.exe
   • %User Temp%\final.exe
   • %User Profile%\Scheduler\s_1.dt
   • %User Profile%\Application Data\chrtmp
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To delete malware/grayware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Profile%\Application Data\DMCache
   • %User Profile%\Application Data\IDM
   • %User Profile%\My Documents\Downloads
   • %User Profile%\Downloads\Compressed
   • %User Profile%\Downloads\Documents
   • %User Profile%\Downloads\Music
   • %User Profile%\Downloads\Programs
   • %User Profile%\Downloads\Video
   • %User Profile%\IDM\Grabber
   • %User Profile%\Grabber\Projects
   • %User Profile%\IDM\Scheduler
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat the said steps for all folders listed.