TROJ_FAKEAV.AJA

To terminate the malware/grayware process:

1. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC then click the Processes tab.
2. In the list of running programs*, locate the malware/grayware file/s detected earlier.
3. Select one of the detected files then press the End Process button.
4. Do the same for all detected malware/grayware files in the list of running processes.
5. To check if the malware/grayware process/es has/have been terminated, close Windows Task Manager then open it again.
6. Close Windows Task Manager.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
3. In the right panel, locate and delete the entry:
   Use FormSuggest = "Yes"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings
5. In the right panel, locate and delete the entry:
   WarnOnZoneCrossing = 0
6. Again In the right panel, locate and delete the entry:
   WarnonBadCertRecving = 0
7. Again In the right panel, locate and delete the entry:
   CertificateRevocation = 0
8. Close Registry Editor.

To delete the registry key this malware/grayware/spyware created:

1. Restart your computer in Safe Mode. For instructions on how to do this, you may refer to this page. If the preceding step requires you to restart in safe mode, you may proceed to #2.
2. Open Registry Editor. To do this, click Start>Run, type REGEDIT in the text box provided, then press Enter.
3. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft
4. Still in the left panel, locate and delete the key:
   GDIPlus
5. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>ESENT>Process
6. Still in the left panel, locate and delete the key:
   {Malware File Name}
7. Close Registry Editor.

To delete the malware/grayware folder:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   

   • %User Profile%\Start Menu\Programs\SMART HDD

3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.

To delete the malware/grayware/spyware file:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\Documents and Settings\All Users\Application Data\{Random File Name}
   • %System Root%\Documents and Settings\All Users\Application Data\-{Random File Name}
   • %System Root%\Documents and Settings\All Users\Application Data\-{Random File Name}r
   • %Application Data%\GDIPFONTCACHEV1.DAT
   • %User Profile%\Desktop\SMART_HDD.lnk
   • %User Profile%\Application Data\Microsoft\Internet Explorer\Quick Launch\SMART_HDD.lnk
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the file then press SHIFT+DELETE to permanently delete the file.

To reset Internet security settings:

1. Close all Internet broser windows.
2. Open Control Panel. To do this:
   • On Windows 2000
   Click Start>Settings>Control Panel
   • On Windows XP and Server 2003
   Click Start>Control Panel
3. Double-click Internet Options.
4. In the Internet Properties window, click the Security tab.
5. For each Web content zone, click on the Default Level button to set each zone to the default setting.
6. Click OK.