TROJ_ADLOAD.KHK

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
3. Still in the left panel, locate and delete the key:
   RegisteredApplicationsEx
4. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
5. Still in the left panel, locate and delete the key:
   CostMin.CostMin.2.2
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CostMin.CostMin.2.2
7. Still in the left panel, locate and delete the key:
   CLSID
8. Again Still in the left panel, locate and delete the key:
   CostMin.CostMin
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CostMin.CostMin
10. Still in the left panel, locate and delete the key:
    CLSID
11. Again Still in the left panel, locate and delete the key:
    CurVer
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
13. Still in the left panel, locate and delete the key:
    {82B533F2-DF4C-C8BF-521B-BB121D7EC425}
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{82B533F2-DF4C-C8BF-521B-BB121D7EC425}
15. Still in the left panel, locate and delete the key:
    ProgID
16. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
17. Again Still in the left panel, locate and delete the key:
    Programmable
18. Again Still in the left panel, locate and delete the key:
    InprocServer32
19. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
20. Still in the left panel, locate and delete the key:
    ApprovedExtensionsMigration
21. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>ApprovedExtensionsMigration
22. Still in the left panel, locate and delete the key:
    {82B533F2-DF4C-C8BF-521B-BB121D7EC425}
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies
24. Still in the left panel, locate and delete the key:
    Ext
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext
26. Still in the left panel, locate and delete the key:
    CLSID
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion
28. Still in the left panel, locate and delete the key:
    Ext
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext
30. Still in the left panel, locate and delete the key:
    PreApproved
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
32. Still in the left panel, locate and delete the key:
    {82B533F2-DF4C-C8BF-521B-BB121D7EC425}
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
34. Still in the left panel, locate and delete the key:
    {E2343056-CC08-46AC-B898-BFC7ACF4E755}
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E2343056-CC08-46AC-B898-BFC7ACF4E755}
36. Still in the left panel, locate and delete the key:
    1.0
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E2343056-CC08-46AC-B898-BFC7ACF4E755}>1.0
38. Still in the left panel, locate and delete the key:
    FLAGS
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E2343056-CC08-46AC-B898-BFC7ACF4E755}>1.0>0
40. Still in the left panel, locate and delete the key:
    win32
41. Again Still in the left panel, locate and delete the key:
    HELPDIR
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
43. Still in the left panel, locate and delete the key:
    {9B41579A-1996-42F9-8F84-7B7786818CEF}
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9B41579A-1996-42F9-8F84-7B7786818CEF}
45. Still in the left panel, locate and delete the key:
    ProxyStubClsid
46. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
47. Again Still in the left panel, locate and delete the key:
    TypeLib
48. Again Still in the left panel, locate and delete the key:
    {7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}
50. Still in the left panel, locate and delete the key:
    ProxyStubClsid
51. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
52. Again Still in the left panel, locate and delete the key:
    TypeLib
53. Again Still in the left panel, locate and delete the key:
    {EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
55. Still in the left panel, locate and delete the key:
    ProxyStubClsid
56. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
57. Again Still in the left panel, locate and delete the key:
    TypeLib
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
59. Still in the left panel, locate and delete the key:
    {2F5F003B-C71B-72E3-42B4-DE51AB079EB2}
60. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}
61. Still in the left panel, locate and delete the key:
    _40030ae4
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}
63. Still in the left panel, locate and delete the key:
    _40030ae4
64. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
65. Still in the left panel, locate and delete the key:
    eae10f9d
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
67. Still in the left panel, locate and delete the key:
    eae10f9d
68. Again Still in the left panel, locate and delete the key:
    00000000
69. Again Still in the left panel, locate and delete the key:
    00000000
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE
71. Still in the left panel, locate and delete the key:
    {77D46E27-0E41-4478-87A6-AABE6FBCF252}
72. Again Still in the left panel, locate and delete the key:
    {5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
73. Again Still in the left panel, locate and delete the key:
    {3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
74. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>RegisteredApplicationsEx
3. In the right panel, locate and delete the entry:
   7602799251d694b331c77ab046b4432e = "1"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{82B533F2-DF4C-C8BF-521B-BB121D7EC425}
5. In the right panel, locate and delete the entry:
   NoExplorer = "1"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{82B533F2-DF4C-C8BF-521B-BB121D7EC425}>InprocServer32
7. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext>CLSID
9. In the right panel, locate and delete the entry:
   {82B533F2-DF4C-C8BF-521B-BB121D7EC425} = "1"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9B41579A-1996-42F9-8F84-7B7786818CEF}>TypeLib
11. In the right panel, locate and delete the entry:
    Version = "1.0"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}>TypeLib
13. In the right panel, locate and delete the entry:
    Version = "1.0"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}>TypeLib
15. In the right panel, locate and delete the entry:
    Version = "1.0"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}
17. In the right panel, locate and delete the entry:
    UninstallString = "%User Profile%\CostMin\zlAfF.exe /s /n /i:ExecuteCommands;UninstallCommands "
18. Again In the right panel, locate and delete the entry:
    SilentUninstall = "%User Profile%\CostMin\zlAfF.exe /s /n /i:ExecuteCommands;UninstallCommands "
19. Again In the right panel, locate and delete the entry:
    DisplayName = "CostMin"
20. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://{BLOCKED}n.info"
21. Again In the right panel, locate and delete the entry:
    URLUpdateInfo = "http://{BLOCKED}n.info"
22. Again In the right panel, locate and delete the entry:
    Publisher = "CostMin"
23. Again In the right panel, locate and delete the entry:
    DisplayVersion = "4.2.0.1600"
24. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
25. Again In the right panel, locate and delete the entry:
    NoModify = "1"
26. Again In the right panel, locate and delete the entry:
    CategoryName = "Apps"
27. Again In the right panel, locate and delete the entry:
    InstallDate = "20140515"
28. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%System%\msiexec.exe"
29. Again In the right panel, locate and delete the entry:
    _In = "20140515"
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
31. In the right panel, locate and delete the entry:
    date = "1400124060"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
33. In the right panel, locate and delete the entry:
    date = "1400124060"
34. Again In the right panel, locate and delete the entry:
    data.0 = "LfdGxYh7sI3XGsurpnX9odN9Tujzny0f"
35. Again In the right panel, locate and delete the entry:
    data.0 = "LfdGxYh7sI3XGsurpnX9odN9Tujzny0f"
36. Again In the right panel, locate and delete the entry:
    data.1 = "WYlOIzNHVQK5UMOQIKqVntT75MiTv5r5sYcU6UgOvFXE"
37. Again In the right panel, locate and delete the entry:
    data.1 = "WYlOIzNHVQK5UMOQIKqVntT75MiTv5r5sYcU6UgOvFXE"
38. Again In the right panel, locate and delete the entry:
    usr.0 = "y2MhbySUMOQIKEG+xz"
39. Again In the right panel, locate and delete the entry:
    usr.0 = "y2MhbySUMOQIKEG+xz"
40. Again In the right panel, locate and delete the entry:
    usr.1 = "tokNRHefABCDWYSUMO"
41. Again In the right panel, locate and delete the entry:
    usr.1 = "tokNRHefABCDWYSUMO"
42. Again In the right panel, locate and delete the entry:
    version = "15761"
43. Again In the right panel, locate and delete the entry:
    uuid = "25fb90de-4d8121b9-68ad0fd0"
44. Again In the right panel, locate and delete the entry:
    uuid = "25fb90de-4d8121b9-68ad0fd0"
45. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>eae10f9d
46. In the right panel, locate and delete the entry:
    a2e3b941 = "///%"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>eae10f9d
48. In the right panel, locate and delete the entry:
    a2e3b941 = "///%"
49. Again In the right panel, locate and delete the entry:
    bbf88800 = "///%"
50. Again In the right panel, locate and delete the entry:
    bbf88800 = "///%"
51. Again In the right panel, locate and delete the entry:
    state = "0"
52. Again In the right panel, locate and delete the entry:
    a1dcff5b = "V/////%%"
53. Again In the right panel, locate and delete the entry:
    a1dcff5b = "V/////%%"
54. Again In the right panel, locate and delete the entry:
    340d3099 = "/P////%%"
55. Again In the right panel, locate and delete the entry:
    340d3099 = "/P////%%"
56. Again In the right panel, locate and delete the entry:
    0e93c3f3 = "///%"
57. Again In the right panel, locate and delete the entry:
    0e93c3f3 = "///%"
58. Again In the right panel, locate and delete the entry:
    0c230bcb = "///%"
59. Again In the right panel, locate and delete the entry:
    0c230bcb = "///%"
60. Again In the right panel, locate and delete the entry:
    27ddcf6f = "///%"
61. Again In the right panel, locate and delete the entry:
    27ddcf6f = "///%"
62. Again In the right panel, locate and delete the entry:
    414bc593 = "///%"
63. Again In the right panel, locate and delete the entry:
    414bc593 = "///%"
64. Again In the right panel, locate and delete the entry:
    f0bf0bde = "///%"
65. Again In the right panel, locate and delete the entry:
    f0bf0bde = "///%"
66. Again In the right panel, locate and delete the entry:
    c99a5f5c = "///%"
67. Again In the right panel, locate and delete the entry:
    c99a5f5c = "///%"
68. Again In the right panel, locate and delete the entry:
    72758a5d = "///%"
69. Again In the right panel, locate and delete the entry:
    72758a5d = "///%"
70. Again In the right panel, locate and delete the entry:
    e46c271e = "///%"
71. Again In the right panel, locate and delete the entry:
    e46c271e = "///%"
72. Again In the right panel, locate and delete the entry:
    7f69fa1f = "///%"
73. Again In the right panel, locate and delete the entry:
    7f69fa1f = "///%"
74. Again In the right panel, locate and delete the entry:
    3c09c42b = "///%"
75. Again In the right panel, locate and delete the entry:
    3c09c42b = "///%"
76. Again In the right panel, locate and delete the entry:
    7367429f = "///%"
77. Again In the right panel, locate and delete the entry:
    7367429f = "///%"
78. Again In the right panel, locate and delete the entry:
    0dc3ee96 = "/P////%%"
79. Again In the right panel, locate and delete the entry:
    0dc3ee96 = "/P////%%"
80. Again In the right panel, locate and delete the entry:
    d1abcdb6 = "///%"
81. Again In the right panel, locate and delete the entry:
    d1abcdb6 = "///%"
82. Again In the right panel, locate and delete the entry:
    38583bc3 = "N//e/Ct/Vx/l/C/////%"
83. Again In the right panel, locate and delete the entry:
    38583bc3 = "N//e/Ct/Vx/l/C/////%"
84. Again In the right panel, locate and delete the entry:
    c24899a6 = "MP/f/CF/Mx/l/C/////%"
85. Again In the right panel, locate and delete the entry:
    c24899a6 = "MP/f/CF/Mx/l/C/////%"
86. Again In the right panel, locate and delete the entry:
    f1f24e29 = "Vl/l/C/////%"
87. Again In the right panel, locate and delete the entry:
    f1f24e29 = "Vl/l/C/////%"
88. Again In the right panel, locate and delete the entry:
    c5705860 = "Vx////%%"
89. Again In the right panel, locate and delete the entry:
    c5705860 = "Vx////%%"
90. Again In the right panel, locate and delete the entry:
    a0743acc = "N/////%%"
91. Again In the right panel, locate and delete the entry:
    a0743acc = "N/////%%"
92. Again In the right panel, locate and delete the entry:
    c6c5dd44 = "V/////%%"
93. Again In the right panel, locate and delete the entry:
    c6c5dd44 = "V/////%%"
94. Again In the right panel, locate and delete the entry:
    1520c6f1 = "V/////%%"
95. Again In the right panel, locate and delete the entry:
    1520c6f1 = "V/////%%"
96. Again In the right panel, locate and delete the entry:
    2d71d5ab = "V/////%%"
97. Again In the right panel, locate and delete the entry:
    2d71d5ab = "V/////%%"
98. Again In the right panel, locate and delete the entry:
    8b9e4cbc = "V/////%%"
99. Again In the right panel, locate and delete the entry:
    8b9e4cbc = "V/////%%"
100. Again In the right panel, locate and delete the entry:
     fe94ce1e = "V/////%%"
101. Again In the right panel, locate and delete the entry:
     fe94ce1e = "V/////%%"
102. Again In the right panel, locate and delete the entry:
     587b5709 = "V/////%%"
103. Again In the right panel, locate and delete the entry:
     587b5709 = "V/////%%"
104. Again In the right panel, locate and delete the entry:
     lrts = "0"
105. Again In the right panel, locate and delete the entry:
     lrts = "0"
106. Again In the right panel, locate and delete the entry:
     mode = "f"
107. Again In the right panel, locate and delete the entry:
     mode = "f"
108. Again In the right panel, locate and delete the entry:
     svn = "Supporter"
109. Again In the right panel, locate and delete the entry:
     svi = "0"
110. Again In the right panel, locate and delete the entry:
     svt = "5374329d"
111. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>00000000
112. In the right panel, locate and delete the entry:
     370856c7 = "{random characters}"
113. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>00000000
114. In the right panel, locate and delete the entry:
     370856c7 = "{random characters}"
115. Again In the right panel, locate and delete the entry:
     3efeb33e = "{random characters}"
116. Again In the right panel, locate and delete the entry:
     3efeb33e = "{random characters}"
117. Again In the right panel, locate and delete the entry:
     060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"
118. Again In the right panel, locate and delete the entry:
     060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"
119. Again In the right panel, locate and delete the entry:
     iiid = "1"
120. Again In the right panel, locate and delete the entry:
     iiid = "1"
121. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Windows
122. In the right panel, locate and delete the entry:
     LoadAppInit_DLLs = "1"
123. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>{77D46E27-0E41-4478-87A6-AABE6FBCF252}
124. In the right panel, locate and delete the entry:
     40030ae4 = "%Program Files%\Supporter\Supporter.dll"
125. Again In the right panel, locate and delete the entry:
     dlpath = "%Program Files%\suppor~1\suppor~1.dll"
126. Again In the right panel, locate and delete the entry:
     svpath = "%Program Files%\suppor~1\SupporterSvc.dll"
127. Again In the right panel, locate and delete the entry:
     Install_Dir = "%Program Files%\Supporter"
128. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
129. In the right panel, locate and delete the entry:
     UninstallString = "%System%\RUNDLL32.EXE %Program Files%\SUPPOR~1\SUPPOR~1.DLL,_uninstall /un"
130. Again In the right panel, locate and delete the entry:
     QuietUninstallString = "{random characters}"
131. Again In the right panel, locate and delete the entry:
     NoModify = "1"
132. Again In the right panel, locate and delete the entry:
     NoRepair = "1"
133. Again In the right panel, locate and delete the entry:
     Publisher = "Costmin"
134. Again In the right panel, locate and delete the entry:
     InstallDate = "20140514"
135. Again In the right panel, locate and delete the entry:
     DisplayName = "Supporter 1.80"
136. Again In the right panel, locate and delete the entry:
     n = "1"
137. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
138. In the right panel, locate and delete the entry:
     n = "1"
139. Again In the right panel, locate and delete the entry:
     dbaf3ce3 = "/P////%%"
140. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Windows
3. In the right panel, locate the registry value:
   AppInit_DLLs = "%Program Files%\suppor~1\suppor~1.dll"
4. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\294823_.exe
   • %User Temp%\18be6784_.exe
   • %User Temp%/554a2507/zlAfF.dat
   • %User Temp%/554a2507/zlAfF.exe
   • %User Temp%/554a2507/Bddi2.dll
   • %User Temp%/554a2507/OK_u.x64.dll
   • %User Temp%/554a2507/OK_u.tlb
   • %User Temp%/554a2507/OK_u.dll
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/content/bg.js
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/install.rdf
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/chrome.manifest
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/bootstrap.js
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/lsdb.js
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/content.js
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/manifest.json
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/background.html
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/yaFvhH.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Program Files%\CostMin\OK_u.dll
   • %Program Files%\CostMin\OK_u.tlb
   • %Program Files%\CostMin\OK_u.dat
   • %Program Files%\CostMin\OK_u.x64.dll
   • %User Profile%\CostMin\zlAfF.exe
   • %User Profile%\CostMin\zlAfF.dat
   • %User Profile%\2635c994ef08bff3\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}
   • %User Temp%\tf00294823.dll
   • %Program Files%\Supporter\Supporter.dll
   • %Program Files%\suppor~1\SupporterSvc.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\294823_.exe
   • %User Temp%\18be6784_.exe
   • %User Temp%/554a2507/zlAfF.dat
   • %User Temp%/554a2507/zlAfF.exe
   • %User Temp%/554a2507/Bddi2.dll
   • %User Temp%/554a2507/OK_u.x64.dll
   • %User Temp%/554a2507/OK_u.tlb
   • %User Temp%/554a2507/OK_u.dll
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/content/bg.js
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/install.rdf
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/chrome.manifest
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/bootstrap.js
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/lsdb.js
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/content.js
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/manifest.json
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/background.html
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm/yaFvhH.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\background.html
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\content.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\lsdb.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\manifest.json
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2\yaFvhH.js
   • %Program Files%\CostMin\OK_u.dll
   • %Program Files%\CostMin\OK_u.tlb
   • %Program Files%\CostMin\OK_u.dat
   • %Program Files%\CostMin\OK_u.x64.dll
   • %User Profile%\CostMin\zlAfF.exe
   • %User Profile%\CostMin\zlAfF.dat
   • %User Profile%\2635c994ef08bff3\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}
   • %User Temp%\tf00294823.dll
   • %Program Files%\Supporter\Supporter.dll
   • %Program Files%\suppor~1\SupporterSvc.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%/554a2507
   • %User Temp%/554a2507/jz1-i@qztoooazis.com
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/content
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm
   • %System Root%\Documents and Settings\Administrator
   • %Application Data%\Google
   • %Application Data%\Google\Chrome
   • %Application Data%\Google\Chrome\User Data
   • %Application Data%\Google\Chrome\User Data\Default
   • %Application Data%\Google\Chrome\User Data\Default\Extensions
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %System Root%\Documents and Settings\ASPNET
   • %System Root%\Documents and Settings\Guest
   • %System Root%\Documents and Settings\HelpAssistant
   • %System Root%\Documents and Settings\SUPPORT_388945a0
   • %Application Data%\Comodo
   • %Application Data%\Comodo\Dragon
   • %Application Data%\Comodo\Dragon\User Data
   • %Application Data%\Comodo\Dragon\User Data\Default
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %Application Data%\Google\Chrome SxS
   • %Application Data%\Google\Chrome SxS\User Data
   • %Application Data%\Google\Chrome SxS\User Data\Default
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %Application Data%\Torch
   • %Application Data%\Torch\User Data
   • %Application Data%\Torch\User Data\Default
   • %Application Data%\Torch\User Data\Default\Extensions
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %Application Data%\Chromatic Browser
   • %Application Data%\Chromatic Browser\User Data
   • %Application Data%\Chromatic Browser\User Data\Default
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %Program Files%\CostMin
   • %User Profile%\AppData
   • %User Profile%\AppData\LocalLow
   • %User Profile%\LocalLow\{82B533F2-DF4C-C8BF-521B-BB121D7EC425}
   • %User Profile%\Application Data\CostMin
   • %User Profile%\Application Data\2635c994ef08bff3
   • %Program Files%\Supporter
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%/554a2507
   • %User Temp%/554a2507/jz1-i@qztoooazis.com
   • %User Temp%/554a2507/jz1-i@qztoooazis.com/content
   • %User Temp%/554a2507/chadpnoelefiijkagieoaghailkmhhmm
   • %System Root%\Documents and Settings\Administrator
   • %Application Data%\Google
   • %Application Data%\Google\Chrome
   • %Application Data%\Google\Chrome\User Data
   • %Application Data%\Google\Chrome\User Data\Default
   • %Application Data%\Google\Chrome\User Data\Default\Extensions
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %System Root%\Documents and Settings\ASPNET
   • %System Root%\Documents and Settings\Guest
   • %System Root%\Documents and Settings\HelpAssistant
   • %System Root%\Documents and Settings\SUPPORT_388945a0
   • %Application Data%\Comodo
   • %Application Data%\Comodo\Dragon
   • %Application Data%\Comodo\Dragon\User Data
   • %Application Data%\Comodo\Dragon\User Data\Default
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %Application Data%\Google\Chrome SxS
   • %Application Data%\Google\Chrome SxS\User Data
   • %Application Data%\Google\Chrome SxS\User Data\Default
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %Application Data%\Torch
   • %Application Data%\Torch\User Data
   • %Application Data%\Torch\User Data\Default
   • %Application Data%\Torch\User Data\Default\Extensions
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Torch\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %Application Data%\Chromatic Browser
   • %Application Data%\Chromatic Browser\User Data
   • %Application Data%\Chromatic Browser\User Data\Default
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\chadpnoelefiijkagieoaghailkmhhmm\2.2
   • %Program Files%\CostMin
   • %User Profile%\AppData
   • %User Profile%\AppData\LocalLow
   • %User Profile%\LocalLow\{82B533F2-DF4C-C8BF-521B-BB121D7EC425}
   • %User Profile%\Application Data\CostMin
   • %User Profile%\Application Data\2635c994ef08bff3
   • %Program Files%\Supporter