TROJ_DLOADER.GIW

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Classes>DRPDD
3. Still in the left panel, locate and delete the key:
   CLSID
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Classes>CLSID
5. Still in the left panel, locate and delete the key:
   {80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Recovery
7. Still in the left panel, locate and delete the key:
   Active
8. Again Still in the left panel, locate and delete the key:
   AdminActive
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software
10. Still in the left panel, locate and delete the key:
    Google
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google
12. Still in the left panel, locate and delete the key:
    Chrome
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google>Chrome
14. Still in the left panel, locate and delete the key:
    Extensions
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google>Chrome>Extensions
16. Still in the left panel, locate and delete the key:
    niapdbllcanepiiimjjndipklodoedlc
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Tarma Installer>Components
18. Still in the left panel, locate and delete the key:
    {9D9785E5-3424-40B6-A287-BA143AD53109}
19. Again Still in the left panel, locate and delete the key:
    {B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}
20. Again Still in the left panel, locate and delete the key:
    {9307081B-7444-494C-8CF6-2FA7C0E92BFB}
21. Again Still in the left panel, locate and delete the key:
    {4E4AE263-5CE6-4307-84B6-B9BFF5729A44}
22. Again Still in the left panel, locate and delete the key:
    {3E454121-D681-4BBE-AC01-9D4DC40D2A04}
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
24. Still in the left panel, locate and delete the key:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B}
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Tarma Installer>Products
26. Still in the left panel, locate and delete the key:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B}
27. Again Still in the left panel, locate and delete the key:
    {FE9271F2-6EFD-44b0-A826-84C829536E93}
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Ext>PreApproved
29. Still in the left panel, locate and delete the key:
    {DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
31. Still in the left panel, locate and delete the key:
    {CFDAFE39-20CE-451D-BD45-A37452F39CF0}
32. Again Still in the left panel, locate and delete the key:
    YontooIEClient.DLL
33. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
34. Still in the left panel, locate and delete the key:
    YontooIEClient.Api.1
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Api.1
36. Still in the left panel, locate and delete the key:
    CLSID
37. Again Still in the left panel, locate and delete the key:
    YontooIEClient.Api
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Api
39. Still in the left panel, locate and delete the key:
    CLSID
40. Again Still in the left panel, locate and delete the key:
    CurVer
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
42. Still in the left panel, locate and delete the key:
    {DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
44. Still in the left panel, locate and delete the key:
    ProgID
45. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
46. Again Still in the left panel, locate and delete the key:
    Programmable
47. Again Still in the left panel, locate and delete the key:
    InprocServer32
48. Again Still in the left panel, locate and delete the key:
    TypeLib
49. Again Still in the left panel, locate and delete the key:
    YontooIEClient.Layers.1
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Layers.1
51. Still in the left panel, locate and delete the key:
    CLSID
52. Again Still in the left panel, locate and delete the key:
    YontooIEClient.Layers
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Layers
54. Still in the left panel, locate and delete the key:
    CLSID
55. Again Still in the left panel, locate and delete the key:
    CurVer
56. Again Still in the left panel, locate and delete the key:
    {FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
58. Still in the left panel, locate and delete the key:
    ProgID
59. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
60. Again Still in the left panel, locate and delete the key:
    Programmable
61. Again Still in the left panel, locate and delete the key:
    InprocServer32
62. Again Still in the left panel, locate and delete the key:
    TypeLib
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
64. Still in the left panel, locate and delete the key:
    {D372567D-67C1-4B29-B3F0-159B52B3E967}
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D372567D-67C1-4B29-B3F0-159B52B3E967}
66. Still in the left panel, locate and delete the key:
    1.0
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D372567D-67C1-4B29-B3F0-159B52B3E967}>1.0
68. Still in the left panel, locate and delete the key:
    FLAGS
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D372567D-67C1-4B29-B3F0-159B52B3E967}>1.0>0
70. Still in the left panel, locate and delete the key:
    win32
71. Again Still in the left panel, locate and delete the key:
    HELPDIR
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
73. Still in the left panel, locate and delete the key:
    {10DE7085-6A1E-4D41-A7BF-9AF93E351401}
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
75. Still in the left panel, locate and delete the key:
    ProxyStubClsid
76. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
77. Again Still in the left panel, locate and delete the key:
    TypeLib
78. Again Still in the left panel, locate and delete the key:
    {1AD27395-1659-4DFF-A319-2CFA243861A5}
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1AD27395-1659-4DFF-A319-2CFA243861A5}
80. Still in the left panel, locate and delete the key:
    ProxyStubClsid
81. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
82. Again Still in the left panel, locate and delete the key:
    TypeLib
83. Again Still in the left panel, locate and delete the key:
    {10DE7085-6A1E-4D41-A7BF-9AF93E351401}
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
85. Still in the left panel, locate and delete the key:
    InProcServer32
86. Again Still in the left panel, locate and delete the key:
    NumMethods
87. Again Still in the left panel, locate and delete the key:
    NumMethods
88. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions>niapdbllcanepiiimjjndipklodoedlc
3. In the right panel, locate and delete the entry:
   path = "%User Temp%\YontooLayers.crx"
4. Again In the right panel, locate and delete the entry:
   version = "1.0.0"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{9D9785E5-3424-40B6-A287-BA143AD53109}
6. In the right panel, locate and delete the entry:
   {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}
8. In the right panel, locate and delete the entry:
   {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{9307081B-7444-494C-8CF6-2FA7C0E92BFB}
10. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{4E4AE263-5CE6-4307-84B6-B9BFF5729A44}
12. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{3E454121-D681-4BBE-AC01-9D4DC40D2A04}
14. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
16. In the right panel, locate and delete the entry:
    UninstallString = "%User Profile%\{889DF~1\Setup.exe /remove /q0"
17. Again In the right panel, locate and delete the entry:
    QuietUninstallString = "%User Profile%\{889DF~1\Setup.exe /remove /q"
18. Again In the right panel, locate and delete the entry:
    ModifyPath = "%User Profile%\{889DF~1\Setup.exe /q0"
19. Again In the right panel, locate and delete the entry:
    Version = "1a1"
20. Again In the right panel, locate and delete the entry:
    VersionMajor = "1"
21. Again In the right panel, locate and delete the entry:
    VersionMinor = "a"
22. Again In the right panel, locate and delete the entry:
    EstimatedSize = "2c7"
23. Again In the right panel, locate and delete the entry:
    Language = "49"
24. Again In the right panel, locate and delete the entry:
    TSAware = "1"
25. Again In the right panel, locate and delete the entry:
    TinFolder = "%User Profile%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"
26. Again In the right panel, locate and delete the entry:
    TinVersion = "5021"
27. Again In the right panel, locate and delete the entry:
    InstallDate = "20121128"
28. Again In the right panel, locate and delete the entry:
    InstallLocation = "%Program Files%\Yontoo Layers Client"
29. Again In the right panel, locate and delete the entry:
    InstallSource = "%User Temp%\nsh5.tmp"
30. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico"
31. Again In the right panel, locate and delete the entry:
    DisplayName = "Yontoo Layers Client 1.10.01"
32. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.10.01"
33. Again In the right panel, locate and delete the entry:
    Publisher = "Yontoo Technology, Inc."
34. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://www.{BLOCKED}o.com"
35. Again In the right panel, locate and delete the entry:
    Contact = "support@yontoo.com"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Products>{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
37. In the right panel, locate and delete the entry:
    TizPath = "%User Temp%\nsh5.tmp\drpdndls.exe"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>YontooIEClient.DLL
39. In the right panel, locate and delete the entry:
    AppID = "{CFDAFE39-20CE-451D-BD45-A37452F39CF0}"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}>InprocServer32
41. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}>InprocServer32
43. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
45. In the right panel, locate and delete the entry:
    NoExplorer = "1"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}>TypeLib
47. In the right panel, locate and delete the entry:
    Version = "1.0"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1AD27395-1659-4DFF-A319-2CFA243861A5}>TypeLib
49. In the right panel, locate and delete the entry:
    Version = "1.0"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}>InProcServer32
51. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
52. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsc2.tmp
   • %User Temp%\nsx3.tmp\inetc.dll
   • %User Temp%\nsx3.tmp\tmp
   • %User Temp%\nsx3.tmp\nsDialogs.dll
   • %User Temp%\nsx3.tmp\bg.bmp
   • %User Temp%\nsx3.tmp\System.dll
   • %User Temp%\nsx3.tmp\PageRageLayers.exe
   • %User Temp%\nsh5.tmp\System.dll
   • %User Temp%\nsh5.tmp\drpdndls.exe
   • %User Temp%\nsh5.tmp\NSISdl.dll
   • %User Temp%\nsh5.tmp\regb
   • %User Temp%\drpdndls-0BE8.exe
   • %User Temp%\C284AD06.dat
   • %User Temp%\C284AD06\_Setup.dll
   • %User Temp%\C284AD06\Setup.ico
   • %User Temp%\C284AD06\_Setupx.dll
   • %User Temp%\YontooTix84781.log
   • %User Temp%\C284AD06\x86\regsvr32.exe
   • %User Temp%\C284AD06\x64\regsvr32.exe
   • %User Temp%\7za.exe._tm
   • %Program Files%\Yontoo Layers Client\YontooIEClient.dll._tm
   • %User Temp%\InstallHandler.txt.tmp
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsc2.tmp
   • %User Temp%\nsx3.tmp\inetc.dll
   • %User Temp%\nsx3.tmp\tmp
   • %User Temp%\nsx3.tmp\nsDialogs.dll
   • %User Temp%\nsx3.tmp\bg.bmp
   • %User Temp%\nsx3.tmp\System.dll
   • %User Temp%\nsx3.tmp\PageRageLayers.exe
   • %User Temp%\nsh5.tmp\System.dll
   • %User Temp%\nsh5.tmp\drpdndls.exe
   • %User Temp%\nsh5.tmp\NSISdl.dll
   • %User Temp%\nsh5.tmp\regb
   • %User Temp%\drpdndls-0BE8.exe
   • %User Temp%\C284AD06.dat
   • %User Temp%\C284AD06\_Setup.dll
   • %User Temp%\C284AD06\Setup.ico
   • %User Temp%\C284AD06\_Setupx.dll
   • %User Temp%\YontooTix84781.log
   • %User Temp%\C284AD06\x86\regsvr32.exe
   • %User Temp%\C284AD06\x64\regsvr32.exe
   • %User Temp%\7za.exe._tm
   • %Program Files%\Yontoo Layers Client\YontooIEClient.dll._tm
   • %User Temp%\InstallHandler.txt.tmp
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

*Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsx3.tmp
   • %User Temp%\nsh5.tmp
   • %User Temp%\C284AD06
   • %User Profile%\Application Data\Tarma Installer
   • %User Profile%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Cache
   • %User Temp%\C284AD06\x86
   • %User Temp%\C284AD06\x64
   • %Program Files%\Yontoo Layers Client
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsx3.tmp
   • %User Temp%\nsh5.tmp
   • %User Temp%\C284AD06
   • %User Profile%\Application Data\Tarma Installer
   • %User Profile%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Cache
   • %User Temp%\C284AD06\x86
   • %User Temp%\C284AD06\x64
   • %Program Files%\Yontoo Layers Client