TROJ_LEMIR.CS

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{0BC9BC01-54D4-4CCE-2B7D-955164314CD4}
3. Still in the left panel, locate and delete the key:
   InProcServer32
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
5. Still in the left panel, locate and delete the key:
   Search
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{0656A137-B161-CADD-9777-E37A75727E78}
7. Still in the left panel, locate and delete the key:
   InProcServer32
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>WindowsFirewall
9. Still in the left panel, locate and delete the key:
   DomainProfile
10. Again Still in the left panel, locate and delete the key:
    StandardProfile
11. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>WAB>WAB4
12. Still in the left panel, locate and delete the key:
    Wab File Name
13. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>CLSID>{0BC9BC01-54D4-4CCE-2B7D-955164314CD4}>InProcServer32
3. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>SharedTaskScheduler
5. In the right panel, locate and delete the entry:
   {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} = "OLE Module"
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
7. In the right panel, locate and delete the entry:
   Default_Search_URL = "http://www.{BLOCKED}-world.biz"
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
9. In the right panel, locate and delete the entry:
   Search = "http://www.{BLOCKED}-world.biz"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Search
11. In the right panel, locate and delete the entry:
    CustomizeSearch = "http://www.{BLOCKED}-world.biz"
12. Again In the right panel, locate and delete the entry:
    SearchAssistant = "http://www.{BLOCKED}-world.biz"
13. Again In the right panel, locate and delete the entry:
    SearchURL = "http://www.{BLOCKED}-world.biz"
14. Again In the right panel, locate and delete the entry:
    Search Bar = "http://www.{BLOCKED}-world.biz"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer
16. In the right panel, locate and delete the entry:
    Search = "http://www.LOX.com/index.html"
17. Again In the right panel, locate and delete the entry:
    SearchURL = "http://www.LOX.com/index.html"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Main
19. In the right panel, locate and delete the entry:
    Search Bar = "http://www.LOX.com/index.html"
20. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CLSID>{0656A137-B161-CADD-9777-E37A75727E78}>InProcServer32
21. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
22. Again In the right panel, locate and delete the entry:
    {0656A137-B161-CADD-9777-E37A75727E78} = "OLE Module"
23. Again In the right panel, locate and delete the entry:
    Play_Background_Sounds = "no"
24. Again In the right panel, locate and delete the entry:
    Display Inline Videos = "no"
25. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Security
26. In the right panel, locate and delete the entry:
    id = "381508561458"
27. Again In the right panel, locate and delete the entry:
    rpt = "2599"
28. Again In the right panel, locate and delete the entry:
    dll = "0"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>WindowsUpdate
30. In the right panel, locate and delete the entry:
    DoNotAllowXPSP2 = "1"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>WindowsUpdate>Auto Update
32. In the right panel, locate and delete the entry:
    AUOptions = "1"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>WindowsFirewall>DomainProfile
34. In the right panel, locate and delete the entry:
    EnableFirewall = "0"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>WindowsFirewall>StandardProfile
36. In the right panel, locate and delete the entry:
    EnableFirewall = "0"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Internet Settings>Zones
38. In the right panel, locate and delete the entry:
    1001 = "1"
39. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Zones
40. In the right panel, locate and delete the entry:
    1001 = "1"
41. Again In the right panel, locate and delete the entry:
    1004 = "1"
42. Again In the right panel, locate and delete the entry:
    1004 = "1"
43. Again In the right panel, locate and delete the entry:
    1200 = "0"
44. Again In the right panel, locate and delete the entry:
    1200 = "0"
45. Again In the right panel, locate and delete the entry:
    1809 = "3"
46. Again In the right panel, locate and delete the entry:
    1809 = "3"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>SharedDlls
48. In the right panel, locate and delete the entry:
    %Program Files%\Common Files\System\wab32.dll = "1"
49. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>WAB>WAB4
50. In the right panel, locate and delete the entry:
    OlkContactRefresh = "0"
51. Again In the right panel, locate and delete the entry:
    OlkFolderRefresh = "0"
52. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Identities>{8A24C031-62FE-4BF5-94F0-BFD4FBCD674B}
53. In the right panel, locate and delete the entry:
    Identity Ordinal = "1"
54. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
3. In the right panel, locate the registry value:
   Search Page = "http://www.{BLOCKED}-world.biz"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Search Page = "http://www.microsoft.com/isapi/redir.dll?prd
5. Again In the right panel, locate the registry value:
   Start Page = "http://www.{BLOCKED}-world.biz"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Start Page = "http://www.microsoft.com/isapi/redir.dll?prd
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Main
8. In the right panel, locate the registry value:
   Search Page = "http://www.LOX.com/index.html"
9. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Search Page = "http://www.microsoft.com/isapi/redir.dll?prd
10. Again In the right panel, locate the registry value:
    Default_Search_URL = "http://www.LOX.com/index.html"
11. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Default_Search_URL = "http://www.microsoft.com/isapi/redir.dll?prd
12. Again In the right panel, locate the registry value:
    Start Page = "http://www.LOX.com/index.html"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Start Page = "http://www.microsoft.com/isapi/redir.dll?prd
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Search
15. In the right panel, locate the registry value:
    CustomizeSearch = "http://www.LOX.com/index.html"
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    CustomizeSearch = "http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
17. Again In the right panel, locate the registry value:
    SearchAssistant = "http://www.LOX.com/index.html"
18. Right-click on the value name and choose Modify. Change the value data of this entry to:
    SearchAssistant = "http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center
20. In the right panel, locate the registry value:
    AntiVirusDisableNotify = "1"
21. Again In the right panel, locate the registry value:
    FirewallDisableNotify = "1"
22. Again In the right panel, locate the registry value:
    AntiVirusOverride = "1"
23. Again In the right panel, locate the registry value:
    FirewallOverride = "1"
24. Again In the right panel, locate the registry value:
    UpdatesDisableNotify = "1"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>wscsvc
26. In the right panel, locate the registry value:
    Start = "4"
27. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Start = "2"
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Identities
29. In the right panel, locate the registry value:
    Identity Ordinal = "2"
30. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Identity Ordinal = "1"
31. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %System%\smart-search.exe
   • %System%\syst2.exe
   • %System%\syst3.exe
   • %System%\trf32.dll
   • %System%\mscnf.dll
   • %System%\thn32.dll
   • %System%\thn.dll
   • %User Profile%\Address Book\Wilbert.wab
   • %System Root%\mailz.txt
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %System%\smart-search.exe
   • %System%\syst2.exe
   • %System%\syst3.exe
   • %System%\trf32.dll
   • %System%\mscnf.dll
   • %System%\thn32.dll
   • %System%\thn.dll
   • %User Profile%\Address Book\Wilbert.wab
   • %System Root%\mailz.txt
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete the malware/grayware folder:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Profile%\Microsoft\Address Book
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.