Trojan.Win32.FORTNET.A

To terminate the malware/grayware/spyware process:

1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
   • For Windows 7 and Server 2008 (R2) users, click the Processes tab.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file detected earlier.
5. Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
8. Close Task Manager.

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>LabTech
3. Still in the left panel, locate and delete the key:
   Service
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>LabTech>Service
5. Still in the left panel, locate and delete the key:
   Settings
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>eventlog>Application
7. Still in the left panel, locate and delete the key:
   LTService
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>eventlog>Application>LTService
9. Still in the left panel, locate and delete the key:
   EventMessageFile
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>LTService
11. Still in the left panel, locate and delete the key:
    Parameters
12. Again Still in the left panel, locate and delete the key:
    LastScan
13. Again Still in the left panel, locate and delete the key:
    AutoStartup
14. Again Still in the left panel, locate and delete the key:
    VirusScanners
15. Again Still in the left panel, locate and delete the key:
    CleanUp
16. Again Still in the left panel, locate and delete the key:
    Trackers
17. Again Still in the left panel, locate and delete the key:
    Monitors
18. Again Still in the left panel, locate and delete the key:
    SNMPTraps
19. Again Still in the left panel, locate and delete the key:
    SyslogTraps
20. Again Still in the left panel, locate and delete the key:
    PushAccounts
21. Again Still in the left panel, locate and delete the key:
    Subnets
22. Again Still in the left panel, locate and delete the key:
    LabVNC
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>LabTech>LabVNC
24. Still in the left panel, locate and delete the key:
    default
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>LabTech>Service>Settings
26. Still in the left panel, locate and delete the key:
    Schedule
27. Again Still in the left panel, locate and delete the key:
    DeviceLibrary
28. Again Still in the left panel, locate and delete the key:
    DetectionTemplates
29. Again Still in the left panel, locate and delete the key:
    CollectionTemplates
30. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-2407829820-1079796033-203259571-500>SOFTWARE>Software>Sysinternals
31. Still in the left panel, locate and delete the key:
    PsExec
32. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Sysinternals
33. Still in the left panel, locate and delete the key:
    PsExec
34. Again Still in the left panel, locate and delete the key:
    PsKill
35. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Wow6432Node>Sysinternals
36. Still in the left panel, locate and delete the key:
    PsExec
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Wow6432Node>Sysinternals
38. Still in the left panel, locate and delete the key:
    PsExec
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Sysinternals
40. Still in the left panel, locate and delete the key:
    PsExec
41. Again Still in the left panel, locate and delete the key:
    PsKill
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>UltraVNC
43. Still in the left panel, locate and delete the key:
    WinVNC3
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>ORL
45. Still in the left panel, locate and delete the key:
    WinVNC3
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services
47. Still in the left panel, locate and delete the key:
    LTSvcMon
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Control>SafeBoot>Network
49. Still in the left panel, locate and delete the key:
    LTService
50. Again Still in the left panel, locate and delete the key:
    LabVNC
51. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>LabTech>Service
52. Still in the left panel, locate and delete the key:
    Tray
53. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>LabTech
54. Still in the left panel, locate and delete the key:
    LabVNC
55. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>LabTech>Service
3. In the right panel, locate and delete the entry:
   LocationID = "8"
4. Again In the right panel, locate and delete the entry:
   ServerPassword = "fnpassword"
5. Again In the right panel, locate and delete the entry:
   Server Address = "lts.fortressnetworks.com"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>LabTech>Service>Settings
7. In the right panel, locate and delete the entry:
   UpdateTime = "1/23/2007 9:00:00 AM"
8. Again In the right panel, locate and delete the entry:
   BackupTime = "1/12/2007 9:00:00 AM"
9. Again In the right panel, locate and delete the entry:
   ServerAddress = "lts.fortressnetworks.com"
10. Again In the right panel, locate and delete the entry:
    TrayText = "Fortress Networks"
11. Again In the right panel, locate and delete the entry:
    ShowTicket = "1"
12. Again In the right panel, locate and delete the entry:
    HelpURL = ""
13. Again In the right panel, locate and delete the entry:
    ShowHelp = "1"
14. Again In the right panel, locate and delete the entry:
    ShowTray = "1"
15. Again In the right panel, locate and delete the entry:
    AddRemDesc = "Fortress Networks Monitoring Service"
16. Again In the right panel, locate and delete the entry:
    ShowTicketStatus = "1"
17. Again In the right panel, locate and delete the entry:
    VerifyLookupEmail = "1"
18. Again In the right panel, locate and delete the entry:
    DisablePoweredBy = "1"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>eventlog>Application
20. In the right panel, locate and delete the entry:
    AutoBackupLogFiles = "0"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>services>eventlog>Application>LTService
22. In the right panel, locate and delete the entry:
    EventMessageFile = "%Windows%\Microsoft.NET\Framework64\v2.0.50727\EventLogMessages.dll"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>LTService
24. In the right panel, locate and delete the entry:
    DisplayName = "LabTech Monitoring Service"
25. Again In the right panel, locate and delete the entry:
    Description = "{random characters}"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>LabTech>LabVNC
27. In the right panel, locate and delete the entry:
    AllowLoopback = "1"
28. Again In the right panel, locate and delete the entry:
    LoopbackOnly = "1"
29. Again In the right panel, locate and delete the entry:
    AuthRequired = "0"
30. Again In the right panel, locate and delete the entry:
    DisableTrayIcon = "1"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>LabTech>LabVNC>default
32. In the right panel, locate and delete the entry:
    AutoPortSelect = "0"
33. Again In the right panel, locate and delete the entry:
    RemoveWallpaper = "0"
34. Again In the right panel, locate and delete the entry:
    PortNumber = "4999"
35. Again In the right panel, locate and delete the entry:
    HTTPConnect = "0"
36. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-2407829820-1079796033-203259571-500>Software>Software>Sysinternals>PsExec
37. In the right panel, locate and delete the entry:
    EulaAccepted = "1"
38. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>SOFTWARE>Sysinternals>PsExec
39. In the right panel, locate and delete the entry:
    EulaAccepted = "1"
40. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>SOFTWARE>Sysinternals>PsKill
41. In the right panel, locate and delete the entry:
    EulaAccepted = "1"
42. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>SOFTWARE>Sysinternals>C
43. In the right panel, locate and delete the entry:
    EulaAccepted = "1"
44. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>SOFTWARE>Wow6432Node>Sysinternals>C
45. In the right panel, locate and delete the entry:
    EulaAccepted = "1"
46. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>SOFTWARE>Wow6432Node>Sysinternals>PsExec
47. In the right panel, locate and delete the entry:
    EulaAccepted = "1"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Sysinternals>PsExec
49. In the right panel, locate and delete the entry:
    EulaAccepted = "1"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Sysinternals>PsExec
51. In the right panel, locate and delete the entry:
    EulaAccepted = "1"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Sysinternals>PsKill
53. In the right panel, locate and delete the entry:
    EulaAccepted = "1"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>UltraVNC>WinVNC3
55. In the right panel, locate and delete the entry:
    AllowLoopback = "1"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>UltraVNC
57. In the right panel, locate and delete the entry:
    AllowLoopback = "1"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>ORL>WinVNC3
59. In the right panel, locate and delete the entry:
    AllowLoopback = "1"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>LTSvcMon
61. In the right panel, locate and delete the entry:
    Start = "2"
62. Again In the right panel, locate and delete the entry:
    Version = "40.193"
63. Again In the right panel, locate and delete the entry:
    ServerPassword = "RHtqDpZZp8/Zh2ZY2vbWFw
64. Again In the right panel, locate and delete the entry:
    MasterPC = "False"
65. Again In the right panel, locate and delete the entry:
    CommunityStrings = "public,"
66. Again In the right panel, locate and delete the entry:
    SnmpCollectionTemplate = "0"
67. Again In the right panel, locate and delete the entry:
    SNMPCommunity = "public"
68. Again In the right panel, locate and delete the entry:
    SyslogFilter = ""
69. Again In the right panel, locate and delete the entry:
    TFTPFilter = ""
70. Again In the right panel, locate and delete the entry:
    Usernames = ""
71. Again In the right panel, locate and delete the entry:
    StartupNew = "0"
72. Again In the right panel, locate and delete the entry:
    Probe = "0"
73. Again In the right panel, locate and delete the entry:
    TFTPUpload = "1"
74. Again In the right panel, locate and delete the entry:
    LabtechPush = "1"
75. Again In the right panel, locate and delete the entry:
    VirtualHost = "False"
76. Again In the right panel, locate and delete the entry:
    VirtualMachine = "False"
77. Again In the right panel, locate and delete the entry:
    ClientID = "0"
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>LabTech>Service>LastScan
79. In the right panel, locate and delete the entry:
    1 = "8/30/2019 11:53:55 PM"
80. Again In the right panel, locate and delete the entry:
    2 = "8/30/2019 11:53:55 PM"
81. Again In the right panel, locate and delete the entry:
    3 = "8/30/2019 11:53:55 PM"
82. Again In the right panel, locate and delete the entry:
    4 = "8/30/2019 11:53:55 PM"
83. Again In the right panel, locate and delete the entry:
    5 = "8/30/2019 11:53:55 PM"
84. Again In the right panel, locate and delete the entry:
    6 = "8/30/2019 11:53:55 PM"
85. Again In the right panel, locate and delete the entry:
    7 = "8/30/2019 11:53:55 PM"
86. Again In the right panel, locate and delete the entry:
    8 = "8/30/2019 11:53:55 PM"
87. Again In the right panel, locate and delete the entry:
    9 = "8/30/2019 11:53:55 PM"
88. Again In the right panel, locate and delete the entry:
    10 = "8/30/2019 11:53:55 PM"
89. Again In the right panel, locate and delete the entry:
    11 = "8/30/2019 11:53:55 PM"
90. Again In the right panel, locate and delete the entry:
    12 = "8/30/2019 11:53:55 PM"
91. Again In the right panel, locate and delete the entry:
    13 = "8/30/2019 11:53:55 PM"
92. Again In the right panel, locate and delete the entry:
    14 = "8/30/2019 11:53:55 PM"
93. Again In the right panel, locate and delete the entry:
    15 = "8/30/2019 11:53:55 PM"
94. Again In the right panel, locate and delete the entry:
    16 = "8/30/2019 11:53:55 PM"
95. Again In the right panel, locate and delete the entry:
    AllowVNCDisable = "1"
96. Again In the right panel, locate and delete the entry:
    BackupPass = ""
97. Again In the right panel, locate and delete the entry:
    BackupServer = ""
98. Again In the right panel, locate and delete the entry:
    BackupUser = ""
99. Again In the right panel, locate and delete the entry:
    CacheDir = "%windir%\Temp\LTCache"
100. Again In the right panel, locate and delete the entry:
     CachePatch = "1"
101. Again In the right panel, locate and delete the entry:
     CacheSoftware = "1"
102. Again In the right panel, locate and delete the entry:
     CacheUpdate = "1"
103. Again In the right panel, locate and delete the entry:
     CustomURL = ""
104. Again In the right panel, locate and delete the entry:
     Debuging = "1"
105. Again In the right panel, locate and delete the entry:
     PatchTime = "1/4/2007 4:00:00 AM"
106. Again In the right panel, locate and delete the entry:
     RebootMode = "0"
107. Again In the right panel, locate and delete the entry:
     ReportFreq = "300"
108. Again In the right panel, locate and delete the entry:
     ShowCustom = "0"
109. Again In the right panel, locate and delete the entry:
     SoftwareTime = "1/4/2007 5:00:00 AM"
110. Again In the right panel, locate and delete the entry:
     SupportURL = ""
111. Again In the right panel, locate and delete the entry:
     TempDir = "%windir%\Temp"
112. Again In the right panel, locate and delete the entry:
     VNCMode = "0"
113. Again In the right panel, locate and delete the entry:
     NewMessageText = "New Message Received"
114. Again In the right panel, locate and delete the entry:
     NewRSSFeedText = "RSS Feed Updated"
115. Again In the right panel, locate and delete the entry:
     EnableRSS = "0"
116. Again In the right panel, locate and delete the entry:
     RSSFeedAddress1 = ""
117. Again In the right panel, locate and delete the entry:
     RSSFeedAddress2 = ""
118. Again In the right panel, locate and delete the entry:
     RSSFeedAddress3 = ""
119. Again In the right panel, locate and delete the entry:
     RSSFeedAddress4 = ""
120. Again In the right panel, locate and delete the entry:
     BalloonTipTitleText = "LabTech"
121. Again In the right panel, locate and delete the entry:
     VNCConnectMessage = "{random characters}"
122. Again In the right panel, locate and delete the entry:
     TicketFromName = "From:"
123. Again In the right panel, locate and delete the entry:
     TicketSubjectName = "Subject:"
124. Again In the right panel, locate and delete the entry:
     TechConnectedTitle = "A Technician is Connected"
125. Again In the right panel, locate and delete the entry:
     SystemMessageTitle = "LabTech System Message"
126. Again In the right panel, locate and delete the entry:
     ServiceTicketTitle = "Create Service Ticket"
127. Again In the right panel, locate and delete the entry:
     InterruptUserWithChat = "1"
128. Again In the right panel, locate and delete the entry:
     NewTechChatMessage = "A Technician wants to chat with you."
129. Again In the right panel, locate and delete the entry:
     ChatTitle = "Chat"
130. Again In the right panel, locate and delete the entry:
     NoExit = "0"
131. Again In the right panel, locate and delete the entry:
     RegEditMode = "0"
132. Again In the right panel, locate and delete the entry:
     FileExMode = "0"
133. Again In the right panel, locate and delete the entry:
     ScreenShotMode = "0"
134. Again In the right panel, locate and delete the entry:
     WindowsUpdateMode = "0"
135. Again In the right panel, locate and delete the entry:
     RestartLogoffMessage = "{random characters}"
136. Again In the right panel, locate and delete the entry:
     ShutdownMessage = "The system is requesting to shutdown the computer would you like to proceed?"
137. Again In the right panel, locate and delete the entry:
     FileExpMessage = "{random characters}"
138. Again In the right panel, locate and delete the entry:
     RegExpMessage = "{random characters}"
139. Again In the right panel, locate and delete the entry:
     ScreenShotMessage = "A Technician is requesting a screen capture would you like to Allow this?"
140. Again In the right panel, locate and delete the entry:
     EventLogMode = "0"
141. Again In the right panel, locate and delete the entry:
     ProxyServerURL = ""
142. Again In the right panel, locate and delete the entry:
     ProxyUsername = "8Uf/gRm9AxM
143. Again In the right panel, locate and delete the entry:
     ProxyPassword = "8Uf/gRm9AxM
144. Again In the right panel, locate and delete the entry:
     CacheUsername = "8Uf/gRm9AxM
145. Again In the right panel, locate and delete the entry:
     CachePassword = "8Uf/gRm9AxM
146. Again In the right panel, locate and delete the entry:
     SSLPolicy = "16"
147. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>LabTech>Service>Settings>Schedule
148. In the right panel, locate and delete the entry:
     0 = "1/1/2007 5:00:00 AM"
149. Again In the right panel, locate and delete the entry:
     1 = "1/1/2007 5:00:00 AM"
150. Again In the right panel, locate and delete the entry:
     2 = "1/1/2007 5:00:00 AM"
151. Again In the right panel, locate and delete the entry:
     3 = "1/1/2007 5:00:00 AM"
152. Again In the right panel, locate and delete the entry:
     4 = "1/1/2007 5:00:00 AM"
153. Again In the right panel, locate and delete the entry:
     5 = "1/1/2007 5:00:00 AM"
154. Again In the right panel, locate and delete the entry:
     6 = "1/1/2007 5:00:00 AM"
155. Again In the right panel, locate and delete the entry:
     7 = "1/1/2007 5:00:00 AM"
156. Again In the right panel, locate and delete the entry:
     8 = "1/1/2007 5:00:00 AM"
157. Again In the right panel, locate and delete the entry:
     9 = "1/1/2007 5:00:00 AM"
158. Again In the right panel, locate and delete the entry:
     10 = "1/1/2007 5:00:00 AM"
159. Again In the right panel, locate and delete the entry:
     11 = "1/1/2007 5:00:00 AM"
160. Again In the right panel, locate and delete the entry:
     12 = "1/1/2007 5:00:00 AM"
161. Again In the right panel, locate and delete the entry:
     13 = "1/1/2007 5:00:00 AM"
162. Again In the right panel, locate and delete the entry:
     14 = "1/1/2007 5:00:00 AM"
163. Again In the right panel, locate and delete the entry:
     15 = "1/1/2007 5:00:00 AM"
164. Again In the right panel, locate and delete the entry:
     ID = "823"
165. Again In the right panel, locate and delete the entry:
     ClientID = "1"
166. Again In the right panel, locate and delete the entry:
     Password = "YLaYs1IR9VnyHOfUCtdwg6HbUfQ9MeNk"
167. Again In the right panel, locate and delete the entry:
     Server Address = "https://lts.{BLOCKED}ssnetworks.com"
168. Again In the right panel, locate and delete the entry:
     AllowVNCDisable = "0"
169. Again In the right panel, locate and delete the entry:
     BackupTime = "1/12/2007 1:00:00 AM"
170. Again In the right panel, locate and delete the entry:
     CacheUpdate = "0"
171. Again In the right panel, locate and delete the entry:
     Debuging = "0"
172. Again In the right panel, locate and delete the entry:
     PatchTime = ""
173. Again In the right panel, locate and delete the entry:
     RebootMode = "2"
174. Again In the right panel, locate and delete the entry:
     ServerAddress = "https://lts.{BLOCKED}ssnetworks.com"
175. Again In the right panel, locate and delete the entry:
     SoftwareTime = ""
176. Again In the right panel, locate and delete the entry:
     UpdateTime = "1/6/2007 1:00:00 AM"
177. Again In the right panel, locate and delete the entry:
     InterruptUserWithChat = "0"
178. Again In the right panel, locate and delete the entry:
     ProxyUsername = "CXbeA/htBmM
179. Again In the right panel, locate and delete the entry:
     ProxyPassword = "CXbeA/htBmM
180. Again In the right panel, locate and delete the entry:
     CacheUsername = "CXbeA/htBmM
181. Again In the right panel, locate and delete the entry:
     CachePassword = "CXbeA/htBmM
182. Again In the right panel, locate and delete the entry:
     SSLPolicy = "0"
183. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>LabTech>LabVNC
184. In the right panel, locate and delete the entry:
     AllowLoopback = "1"
185. Again In the right panel, locate and delete the entry:
     AuthRequired = "0"
186. Again In the right panel, locate and delete the entry:
     AutoPortSelect = "0"
187. Again In the right panel, locate and delete the entry:
     LoopbackOnly = "1"
188. Again In the right panel, locate and delete the entry:
     RemoveWallpaper = "0"
189. Again In the right panel, locate and delete the entry:
     HTTPConnect = "0"
190. Again In the right panel, locate and delete the entry:
     PortNumber = "4998"
191. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>LTService
192. In the right panel, locate and delete the entry:
     DisplayName = ""
193. Again In the right panel, locate and delete the entry:
     Start = "SERVICE_AUTO_START"
194. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %AppDataLocal%\GDIPFONTCACHEV1.DAT
   • %Windows%\LTSvc\nsoftware.ipworks.dll
   • %Windows%\LTSvc\PS.exe
   • %Windows%\LTSvc\nsoftware.IPWorksSSNMP.dll
   • %Windows%\LTSvc\vnchooks.dll
   • %All Users Profile%\Start Menu\Programs\Startup\Network Monitoring Tray.lnk
   • %Windows%\LTSvc\LTTray.exe
   • %User Temp%\InstallUtil.InstallLog
   • %Windows%\Temp\CabBDF7.tmp
   • %Windows%\LTSvc\ICSharpCode.SharpZipLib.dll
   • %Windows%\LTSvc\LTErrors.txt
   • %Windows%\LTSvc\nsoftware.System.dll
   • %Windows%\Temp\Cab7AAB.tmp
   • %Windows%\Temp\Cab9F5C.tmp
   • %Windows%\LTSvc\labvnc.exe
   • %Windows%\Temp\CabA7D6.tmp
   • %Windows%\LTSvc\LTSVC.InstallState
   • %Windows%\LTSvc\nsoftware.IPWorksSSH.dll
   • %Windows%\LTSvc\LabTech.ico
   • %Windows%\LTSvc\Interfaces.dll
   • %User Temp%\LTErrors.txt
   • %User Temp%\LTTray.dat
   • %Windows%\LTSvc\Interop.WUApiLib.dll
   • %Windows%\LTSvc\SCHook.dll
   • %Windows%\LTSvc\LTSVC.InstallLog
   • %Windows%\LTSvc\cad.exe
   • %Windows%\LTSvc\LTSVC.exe
   • %Windows%\Temp\TarA7D7.tmp
   • %Windows%\LTSvc\LTSvcMon.exe
   • %Windows%\Temp\TarBDF8.tmp
   • %Windows%\Temp\Tar9F5D.tmp
   • %Windows%\Temp\Tar7AAC.tmp
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

To delete malware/grayware/spyware folders:

For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Windows%\LTSvc\Plugins
   • %Windows%\LTSvc
   • %All Users Profile%\Labtech
   • %All Users Profile%\Labtech\Tickets
   • %Windows%\Temp\LTCache
   • %All Users Profile%\Labtech\Responses
   • %All Users Profile%\Labtech\Inbox
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %Windows%\LTSvc\Plugins
   • %Windows%\LTSvc
   • %All Users Profile%\Labtech
   • %All Users Profile%\Labtech\Tickets
   • %Windows%\Temp\LTCache
   • %All Users Profile%\Labtech\Responses
   • %All Users Profile%\Labtech\Inbox
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).