TrojanSpy.Win32.EMOTET.THLAOAI

To terminate the malware/grayware/spyware process:

1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
   • For Windows 7 and Server 2008 (R2) users, click the Processes tab.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file detected earlier.
5. Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
8. Close Task Manager.

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>SessionInfo>1
3. Still in the left panel, locate and delete the key:
   WHCIconStartup
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.3g2>OpenWithProgids
5. Still in the left panel, locate and delete the key:
   WMP11.AssocFile.3G2
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.3gp>OpenWithProgids
7. Still in the left panel, locate and delete the key:
   WMP11.AssocFile.3GP
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.3gp2>OpenWithProgids
9. Still in the left panel, locate and delete the key:
   WMP11.AssocFile.3G2
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.3gpp>OpenWithProgids
11. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.3GP
12. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.AAC>OpenWithProgids
13. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.ADTS
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ADT>OpenWithProgids
15. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.ADTS
16. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ADTS>OpenWithProgids
17. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.ADTS
18. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.aif>OpenWithProgids
19. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.AIFF
20. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.aifc>OpenWithProgids
21. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.AIFF
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.aiff>OpenWithProgids
23. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.AIFF
24. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.asf>OpenWithProgids
25. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.ASF
26. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.asx>OpenWithProgids
27. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.ASX
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.au>OpenWithProgids
29. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.AU
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.avi>OpenWithProgids
31. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.AVI
32. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.bmp>OpenWithProgids
33. Still in the left panel, locate and delete the key:
    Paint.Picture
34. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.cab>OpenWithProgids
35. Still in the left panel, locate and delete the key:
    CABFolder
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.contact>OpenWithProgids
37. Still in the left panel, locate and delete the key:
    contact_wab_auto_file
38. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.css>OpenWithProgids
39. Still in the left panel, locate and delete the key:
    CSSfile
40. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.csv>OpenWithProgids
41. Still in the left panel, locate and delete the key:
    Excel.CSV
42. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.dib>OpenWithProgids
43. Still in the left panel, locate and delete the key:
    Paint.Picture
44. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.dll>OpenWithProgids
45. Still in the left panel, locate and delete the key:
    dllfile
46. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.doc>OpenWithProgids
47. Still in the left panel, locate and delete the key:
    Word.Document.8
48. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.docm>OpenWithProgids
49. Still in the left panel, locate and delete the key:
    Word.DocumentMacroEnabled.12
50. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.docx>OpenWithProgids
51. Still in the left panel, locate and delete the key:
    Word.Document.12
52. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.dot>OpenWithProgids
53. Still in the left panel, locate and delete the key:
    Word.Template.8
54. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.dotm>OpenWithProgids
55. Still in the left panel, locate and delete the key:
    Word.TemplateMacroEnabled.12
56. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.dotx>OpenWithProgids
57. Still in the left panel, locate and delete the key:
    Word.Template.12
58. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.DVR>OpenWithProgids
59. Still in the left panel, locate and delete the key:
    MediaCenter.DVR
60. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.DVR-MS>OpenWithProgids
61. Still in the left panel, locate and delete the key:
    MediaCenter.DVR-MS
62. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.dwfx>OpenWithProgids
63. Still in the left panel, locate and delete the key:
    Windows.XPSReachViewer
64. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.easmx>OpenWithProgids
65. Still in the left panel, locate and delete the key:
    Windows.XPSReachViewer
66. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.edrwx>OpenWithProgids
67. Still in the left panel, locate and delete the key:
    Windows.XPSReachViewer
68. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.emf>OpenWithProgids
69. Still in the left panel, locate and delete the key:
    emffile
70. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.eprtx>OpenWithProgids
71. Still in the left panel, locate and delete the key:
    Windows.XPSReachViewer
72. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.exe>OpenWithProgids
73. Still in the left panel, locate and delete the key:
    exefile
74. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.fon>OpenWithProgids
75. Still in the left panel, locate and delete the key:
    fonfile
76. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.gif>OpenWithProgids
77. Still in the left panel, locate and delete the key:
    giffile
78. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.htm>OpenWithProgids
79. Still in the left panel, locate and delete the key:
    htmlfile
80. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.html>OpenWithProgids
81. Still in the left panel, locate and delete the key:
    htmlfile
82. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ico>OpenWithProgids
83. Still in the left panel, locate and delete the key:
    icofile
84. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ini>OpenWithProgids
85. Still in the left panel, locate and delete the key:
    inifile
86. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.jfif>OpenWithProgids
87. Still in the left panel, locate and delete the key:
    pjpegfile
88. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.jpe>OpenWithProgids
89. Still in the left panel, locate and delete the key:
    jpegfile
90. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.jpeg>OpenWithProgids
91. Still in the left panel, locate and delete the key:
    jpegfile
92. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.jpg>OpenWithProgids
93. Still in the left panel, locate and delete the key:
    jpegfile
94. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.jtx>OpenWithProgids
95. Still in the left panel, locate and delete the key:
    Windows.XPSReachViewer
96. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.lnk>OpenWithProgids
97. Still in the left panel, locate and delete the key:
    lnkfile
98. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.m1v>OpenWithProgids
99. Still in the left panel, locate and delete the key:
    WMP11.AssocFile.MPEG
100. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.M2T>OpenWithProgids
101. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.M2TS
102. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.M2TS>OpenWithProgids
103. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.M2TS
104. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.M2V>OpenWithProgids
105. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MPEG
106. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.m3u>OpenWithProgids
107. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.m3u
108. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.m4a>OpenWithProgids
109. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.M4A
110. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.m4v>OpenWithProgids
111. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MP4
112. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mht>OpenWithProgids
113. Still in the left panel, locate and delete the key:
     mhtmlfile
114. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mhtml>OpenWithProgids
115. Still in the left panel, locate and delete the key:
     mhtmlfile
116. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mid>OpenWithProgids
117. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MIDI
118. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.midi>OpenWithProgids
119. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MIDI
120. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.MOD>OpenWithProgids
121. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MPEG
122. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mov>OpenWithProgids
123. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MOV
124. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mp2>OpenWithProgids
125. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MP3
126. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mp2v>OpenWithProgids
127. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MPEG
128. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mp3>OpenWithProgids
129. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MP3
130. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mp4>OpenWithProgids
131. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MP4
132. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mp4v>OpenWithProgids
133. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MP4
134. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mpa>OpenWithProgids
135. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MPEG
136. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mpe>OpenWithProgids
137. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MPEG
138. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mpeg>OpenWithProgids
139. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MPEG
140. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mpg>OpenWithProgids
141. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MPEG
142. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.mpv2>OpenWithProgids
143. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MPEG
144. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.msg>OpenWithProgids
145. Still in the left panel, locate and delete the key:
     Outlook.File.msg
146. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.MTS>OpenWithProgids
147. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.M2TS
148. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ocx>OpenWithProgids
149. Still in the left panel, locate and delete the key:
     ocxfile
150. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.odt>OpenWithProgids
151. Still in the left panel, locate and delete the key:
     odtfile
152. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.otf>OpenWithProgids
153. Still in the left panel, locate and delete the key:
     otffile
154. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.png>OpenWithProgids
155. Still in the left panel, locate and delete the key:
     pngfile
156. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.pot>OpenWithProgids
157. Still in the left panel, locate and delete the key:
     PowerPoint.Template.8
158. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.potm>OpenWithProgids
159. Still in the left panel, locate and delete the key:
     PowerPoint.TemplateMacroEnabled.12
160. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.potx>OpenWithProgids
161. Still in the left panel, locate and delete the key:
     PowerPoint.Template.12
162. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ppam>OpenWithProgids
163. Still in the left panel, locate and delete the key:
     PowerPoint.Addin.12
164. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ppsm>OpenWithProgids
165. Still in the left panel, locate and delete the key:
     PowerPoint.SlideShowMacroEnabled.12
166. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ppsx>OpenWithProgids
167. Still in the left panel, locate and delete the key:
     PowerPoint.SlideShow.12
168. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ppt>OpenWithProgids
169. Still in the left panel, locate and delete the key:
     PowerPoint.Show.8
170. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.pptm>OpenWithProgids
171. Still in the left panel, locate and delete the key:
     PowerPoint.ShowMacroEnabled.12
172. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.pptx>OpenWithProgids
173. Still in the left panel, locate and delete the key:
     PowerPoint.Show.12
174. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ps1xml>OpenWithProgids
175. Still in the left panel, locate and delete the key:
     Microsoft.PowerShellXMLData.1
176. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.rle>OpenWithProgids
177. Still in the left panel, locate and delete the key:
     rlefile
178. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.rmi>OpenWithProgids
179. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.MIDI
180. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.rtf>OpenWithProgids
181. Still in the left panel, locate and delete the key:
     Word.RTF.8
182. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.scf>OpenWithProgids
183. Still in the left panel, locate and delete the key:
     SHCmdFile
184. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.search-ms>OpenWithProgids
185. Still in the left panel, locate and delete the key:
     SearchFolder
186. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.shtml>OpenWithProgids
187. Still in the left panel, locate and delete the key:
     shtmlfile
188. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.sldm>OpenWithProgids
189. Still in the left panel, locate and delete the key:
     PowerPoint.SlideMacroEnabled.12
190. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.sldx>OpenWithProgids
191. Still in the left panel, locate and delete the key:
     PowerPoint.Slide.12
192. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.snd>OpenWithProgids
193. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.AU
194. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.sys>OpenWithProgids
195. Still in the left panel, locate and delete the key:
     sysfile
196. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.tif>OpenWithProgids
197. Still in the left panel, locate and delete the key:
     TIFImage.Document
198. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.tiff>OpenWithProgids
199. Still in the left panel, locate and delete the key:
     TIFImage.Document
200. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.TS>OpenWithProgids
201. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.TTS
202. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ttc>OpenWithProgids
203. Still in the left panel, locate and delete the key:
     ttcfile
204. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.ttf>OpenWithProgids
205. Still in the left panel, locate and delete the key:
     ttffile
206. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.TTS>OpenWithProgids
207. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.TTS
208. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.txt>OpenWithProgids
209. Still in the left panel, locate and delete the key:
     txtfile
210. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wav>OpenWithProgids
211. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.WAV
212. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wax>OpenWithProgids
213. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.WAX
214. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wdp>OpenWithProgids
215. Still in the left panel, locate and delete the key:
     wdpfile
216. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wm>OpenWithProgids
217. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.ASF
218. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wma>OpenWithProgids
219. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.WMA
220. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wmf>OpenWithProgids
221. Still in the left panel, locate and delete the key:
     wmffile
222. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wmv>OpenWithProgids
223. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.WMV
224. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wmx>OpenWithProgids
225. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.ASX
226. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wpl>OpenWithProgids
227. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.WPL
228. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.WTV>OpenWithProgids
229. Still in the left panel, locate and delete the key:
     MediaCenter.WTVFile
230. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.wvx>OpenWithProgids
231. Still in the left panel, locate and delete the key:
     WMP11.AssocFile.WVX
232. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xlam>OpenWithProgids
233. Still in the left panel, locate and delete the key:
     Excel.AddInMacroEnabled
234. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xls>OpenWithProgids
235. Still in the left panel, locate and delete the key:
     Excel.Sheet.8
236. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xlsb>OpenWithProgids
237. Still in the left panel, locate and delete the key:
     Excel.SheetBinaryMacroEnabled.12
238. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xlsm>OpenWithProgids
239. Still in the left panel, locate and delete the key:
     Excel.SheetMacroEnabled.12
240. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xlsx>OpenWithProgids
241. Still in the left panel, locate and delete the key:
     Excel.Sheet.12
242. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xlt>OpenWithProgids
243. Still in the left panel, locate and delete the key:
     Excel.Template.8
244. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xltm>OpenWithProgids
245. Still in the left panel, locate and delete the key:
     Excel.TemplateMacroEnabled
246. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xltx>OpenWithProgids
247. Still in the left panel, locate and delete the key:
     Excel.Template
248. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xml>OpenWithProgids
249. Still in the left panel, locate and delete the key:
     xmlfile
250. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xps>OpenWithProgids
251. Still in the left panel, locate and delete the key:
     Windows.XPSReachViewer
252. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.xsl>OpenWithProgids
253. Still in the left panel, locate and delete the key:
     xslfile
254. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>FileExts>.zip>OpenWithProgids
255. Still in the left panel, locate and delete the key:
     CompressedFolder
256. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Control>Network
257. Still in the left panel, locate and delete the key:
     NetCfgLockHolder
258. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>ServiceInstances
259. Still in the left panel, locate and delete the key:
     {GUID}
260. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>IKEEXT
3. In the right panel, locate and delete the entry:
   Type = "16"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>AeLookupSvc
5. In the right panel, locate and delete the entry:
   Type = "16"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>NetworkList>Nla>Cache>Intranet
7. In the right panel, locate and delete the entry:
   {89BCDCB3-5725-45A2-94AB-2D6B641209B0} = "\x00PV\xbc\x0f"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center
9. In the right panel, locate and delete the entry:
   cval = "0"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>LanmanServer>Shares
11. In the right panel, locate and delete the entry:
    Users = "\x00\x00\x00\x00\x00\x00\x00"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>PolicyApplicationState
13. In the right panel, locate and delete the entry:
    PolicyState = "0"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Control>Network>NetCfgLockHolder
15. In the right panel, locate and delete the entry:
    (Default) = "iphlpsvc.dll"
16. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-2407829820-1079796033-203259571-500>Software>Microsoft>Windows>CurrentVersion>Group Policy>PolicyApplicationState
17. In the right panel, locate and delete the entry:
    PolicyState = "0"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>Machine>Extension-List>{{GUID}}
19. In the right panel, locate and delete the entry:
    StartTimeLo = "1026249381"
20. Again In the right panel, locate and delete the entry:
    StartTimeHi = "30757067"
21. Again In the right panel, locate and delete the entry:
    EndTimeLo = "1609447381"
22. Again In the right panel, locate and delete the entry:
    EndTimeHi = "30757067"
23. Again In the right panel, locate and delete the entry:
    Status = "0"
24. Again In the right panel, locate and delete the entry:
    LoggingStatus = "0"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>History
26. In the right panel, locate and delete the entry:
    PolicyOverdue = "0"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-2407829820-1079796033-203259571-500>Extension-List>{{GUID}}
28. In the right panel, locate and delete the entry:
    StartTimeLo = "1020159381"
29. Again In the right panel, locate and delete the entry:
    StartTimeHi = "30757067"
30. Again In the right panel, locate and delete the entry:
    EndTimeLo = "1633809382"
31. Again In the right panel, locate and delete the entry:
    EndTimeHi = "30757067"
32. Again In the right panel, locate and delete the entry:
    Status = "0"
33. Again In the right panel, locate and delete the entry:
    LoggingStatus = "0"
34. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-2407829820-1079796033-203259571-500>Software>Microsoft>Windows>CurrentVersion>Group Policy>History
35. In the right panel, locate and delete the entry:
    PolicyOverdue = "0"
36. Again In the right panel, locate and delete the entry:
    PolicyState = "2"
37. Again In the right panel, locate and delete the entry:
    PolicyState = "2"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>groupfill
39. In the right panel, locate and delete the entry:
    DisplayName = "groupfill"
40. Again In the right panel, locate and delete the entry:
    Start = "SERVICE_AUTO_START"
41. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 7 and Server 2008 (R2):
     Click the Start button, type REGEDIT in the Search input field then press Enter.
   • On Windows 8, 8.1, 10, and Server 2012 (R2):
     Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>Browser
3. In the right panel, locate the registry value:
   Type = "16"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Type = "20"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>services>LanmanServer>Parameters
6. In the right panel, locate the registry value:
   Guid = "\x9e8%\x0f\xd6\xe6TM\x85\x07?)\xfbm\xaag"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Guid = "{random values}"
8. Again In the right panel, locate the registry value:
   Guid = "
9. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Guid = "{random values}"
10. Again In the right panel, locate the registry value:
    Guid = "\xce\x897\x11\xd3\x11[E\xb2v\xd9\x93\x1cU\x8f\x03"
11. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Guid = "{random values}"
12. Again In the right panel, locate the registry value:
    Guid = "\xa3\x99\x8b\x89ncA\x82Y\x93\xe2\xaev\x9b\x8c"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Guid = "{random values}"
14. Again In the right panel, locate the registry value:
    Guid = "r\xec\xb0xB\x1d\xd8I\xbenC\xa6\x15l\xa4e"
15. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Guid = "{random values}"
16. Again In the right panel, locate the registry value:
    Guid = "\xb4\x8a'\x831J\x91K\xb6\xffDbg]\xe9a"
17. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Guid = "{random values}"
18. Again In the right panel, locate the registry value:
    Guid = "\x12Q]T\xe7\x0e\xc9C\x88\xd9\xd3$\xd7b\x0c\xfe"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Guid = "{random values}"
20. Again In the right panel, locate the registry value:
    Guid = "\x82`\xbb\xf1\x06\xb8uL\x8f\x98\x87[4\xd2\x19^"
21. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Guid = "{random values}"
22. Again In the right panel, locate the registry value:
    Guid = "e0\x8b\xbc~-\xd8O\xae\x89\xc5o\xfa\x17\xa1"
23. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Guid = "{random values}"
24. Again In the right panel, locate the registry value:
    Guid = "Z,t\xac\xcfa\xdbM\x9cP\xb2\x8e\xae\xbb\xd7i"
25. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Guid = "{random values}"
26. Again In the right panel, locate the registry value:
    Guid = "\xf3mO/\x05x\xbdB\xb3yz\xd7\xb5q\x90"
27. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Guid = "{random values}"
28. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %All Users Profile%\Microsoft\Windows\DRM\drmstore.hds
   • %Windows%\SysWOW64\groupfill.exe
   • %Windows%\Prefetch\CONHOST.EXE-1F3E9D7E.pf
   • %Windows%\Tasks\SCHEDLGU.TXT
   • %Windows%\Prefetch\SEARCHFILTERHOST.EXE-77482212.pf
   • %System Root%\DfsServer
   • %AppDataLocal%\Microsoft\Media Player\CurrentDatabase_372.wmdb
   • %Windows%\Prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf
   • %All Users Profile%\Microsoft\Windows\DRM\v3ks.sec
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

To delete the malware/grayware folder:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %Windows%\ServiceProfiles\NetworkService\AppData\Local\Microsoft
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.