TROJ_AGENT_033894.TOMB

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Tarma Installer>Components
3. Still in the left panel, locate and delete the key:
   {4889CB45-FFEB-486E-8785-D034DAC2ACE6}
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Tarma Installer>Products
5. Still in the left panel, locate and delete the key:
   {361E80BE-388B-4270-BF54-A10C2B756504}
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Recovery
7. Still in the left panel, locate and delete the key:
   Active
8. Again Still in the left panel, locate and delete the key:
   AdminActive
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software
10. Still in the left panel, locate and delete the key:
    Google
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google
12. Still in the left panel, locate and delete the key:
    Chrome
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google>Chrome
14. Still in the left panel, locate and delete the key:
    Extensions
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google>Chrome>Extensions
16. Still in the left panel, locate and delete the key:
    niapdbllcanepiiimjjndipklodoedlc
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Classes>CLSID
18. Still in the left panel, locate and delete the key:
    {80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
19. Again Still in the left panel, locate and delete the key:
    {FE9271F2-6EFD-44b0-A826-84C829536E93}
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Ext>PreApproved
21. Still in the left panel, locate and delete the key:
    {DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
23. Still in the left panel, locate and delete the key:
    {CFDAFE39-20CE-451D-BD45-A37452F39CF0}
24. Again Still in the left panel, locate and delete the key:
    YontooIEClient.DLL
25. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
26. Still in the left panel, locate and delete the key:
    YontooIEClient.Api.1
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Api.1
28. Still in the left panel, locate and delete the key:
    CLSID
29. Again Still in the left panel, locate and delete the key:
    YontooIEClient.Api
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Api
31. Still in the left panel, locate and delete the key:
    CLSID
32. Again Still in the left panel, locate and delete the key:
    CurVer
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
34. Still in the left panel, locate and delete the key:
    {DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
36. Still in the left panel, locate and delete the key:
    ProgID
37. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
38. Again Still in the left panel, locate and delete the key:
    Programmable
39. Again Still in the left panel, locate and delete the key:
    InprocServer32
40. Again Still in the left panel, locate and delete the key:
    TypeLib
41. Again Still in the left panel, locate and delete the key:
    YontooIEClient.Layers.1
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Layers.1
43. Still in the left panel, locate and delete the key:
    CLSID
44. Again Still in the left panel, locate and delete the key:
    YontooIEClient.Layers
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>YontooIEClient.Layers
46. Still in the left panel, locate and delete the key:
    CLSID
47. Again Still in the left panel, locate and delete the key:
    CurVer
48. Again Still in the left panel, locate and delete the key:
    {FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
50. Still in the left panel, locate and delete the key:
    ProgID
51. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
52. Again Still in the left panel, locate and delete the key:
    Programmable
53. Again Still in the left panel, locate and delete the key:
    InprocServer32
54. Again Still in the left panel, locate and delete the key:
    TypeLib
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer
56. Still in the left panel, locate and delete the key:
    Browser Helper Objects
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
58. Still in the left panel, locate and delete the key:
    {D372567D-67C1-4B29-B3F0-159B52B3E967}
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D372567D-67C1-4B29-B3F0-159B52B3E967}
60. Still in the left panel, locate and delete the key:
    1.0
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D372567D-67C1-4B29-B3F0-159B52B3E967}>1.0
62. Still in the left panel, locate and delete the key:
    FLAGS
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D372567D-67C1-4B29-B3F0-159B52B3E967}>1.0>0
64. Still in the left panel, locate and delete the key:
    win32
65. Again Still in the left panel, locate and delete the key:
    HELPDIR
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
67. Still in the left panel, locate and delete the key:
    {10DE7085-6A1E-4D41-A7BF-9AF93E351401}
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
69. Still in the left panel, locate and delete the key:
    ProxyStubClsid
70. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
71. Again Still in the left panel, locate and delete the key:
    TypeLib
72. Again Still in the left panel, locate and delete the key:
    {1AD27395-1659-4DFF-A319-2CFA243861A5}
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1AD27395-1659-4DFF-A319-2CFA243861A5}
74. Still in the left panel, locate and delete the key:
    ProxyStubClsid
75. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
76. Again Still in the left panel, locate and delete the key:
    TypeLib
77. Again Still in the left panel, locate and delete the key:
    {10DE7085-6A1E-4D41-A7BF-9AF93E351401}
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
79. Still in the left panel, locate and delete the key:
    InProcServer32
80. Again Still in the left panel, locate and delete the key:
    NumMethods
81. Again Still in the left panel, locate and delete the key:
    NumMethods
82. Again Still in the left panel, locate and delete the key:
    {9D9785E5-3424-40B6-A287-BA143AD53109}
83. Again Still in the left panel, locate and delete the key:
    {1A975F48-2A3C-44FE-A91C-49D3C12ED0BC}
84. Again Still in the left panel, locate and delete the key:
    {B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}
85. Again Still in the left panel, locate and delete the key:
    {9307081B-7444-494C-8CF6-2FA7C0E92BFB}
86. Again Still in the left panel, locate and delete the key:
    {BB1DCBF2-6F69-4FB5-BA9F-0B46B5F93395}
87. Again Still in the left panel, locate and delete the key:
    {8D8654CD-7FBC-4C7E-84E9-371BFA8DB04E}
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
89. Still in the left panel, locate and delete the key:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B}
90. Again Still in the left panel, locate and delete the key:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B}
91. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{4889CB45-FFEB-486E-8785-D034DAC2ACE6}
3. In the right panel, locate and delete the entry:
   {361E80BE-388B-4270-BF54-A10C2B756504} = "1"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Products>{361E80BE-388B-4270-BF54-A10C2B756504}
5. In the right panel, locate and delete the entry:
   TizPath = "%User Temp%\ezLooker-S-Setup_Suite1.exe"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>YontooIEClient.DLL
7. In the right panel, locate and delete the entry:
   AppID = "{CFDAFE39-20CE-451D-BD45-A37452F39CF0}"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}>InprocServer32
9. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}>InprocServer32
11. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
13. In the right panel, locate and delete the entry:
    NoExplorer = "1"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}>TypeLib
15. In the right panel, locate and delete the entry:
    Version = "1.0"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1AD27395-1659-4DFF-A319-2CFA243861A5}>TypeLib
17. In the right panel, locate and delete the entry:
    Version = "1.0"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{10DE7085-6A1E-4D41-A7BF-9AF93E351401}>InProcServer32
19. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FE9271F2-6EFD-44b0-A826-84C829536E93}
21. In the right panel, locate and delete the entry:
    defaultEnableAppsList = "ezLooker,pagerage,buzzdock,toprelatedtopics,twittube"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{9D9785E5-3424-40B6-A287-BA143AD53109}
23. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{1A975F48-2A3C-44FE-A91C-49D3C12ED0BC}
25. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}
27. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{9307081B-7444-494C-8CF6-2FA7C0E92BFB}
29. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{BB1DCBF2-6F69-4FB5-BA9F-0B46B5F93395}
31. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Components>{8D8654CD-7FBC-4C7E-84E9-371BFA8DB04E}
33. In the right panel, locate and delete the entry:
    {889DF117-14D1-44EE-9F31-C5FB5D47F68B} = "1"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
35. In the right panel, locate and delete the entry:
    UninstallString = "%User Profile%\{889DF~1\Setup.exe /remove /q0"
36. Again In the right panel, locate and delete the entry:
    QuietUninstallString = "%User Profile%\{889DF~1\Setup.exe /remove /q"
37. Again In the right panel, locate and delete the entry:
    ModifyPath = "%User Profile%\{889DF~1\Setup.exe /q0"
38. Again In the right panel, locate and delete the entry:
    Version = "1a2"
39. Again In the right panel, locate and delete the entry:
    VersionMajor = "1"
40. Again In the right panel, locate and delete the entry:
    VersionMinor = "a"
41. Again In the right panel, locate and delete the entry:
    EstimatedSize = "6d8"
42. Again In the right panel, locate and delete the entry:
    Language = "49"
43. Again In the right panel, locate and delete the entry:
    TSAware = "1"
44. Again In the right panel, locate and delete the entry:
    TinFolder = "%User Profile%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}"
45. Again In the right panel, locate and delete the entry:
    TinVersion = "5021"
46. Again In the right panel, locate and delete the entry:
    InstallDate = "20120613"
47. Again In the right panel, locate and delete the entry:
    InstallLocation = "%Program Files%\Yontoo"
48. Again In the right panel, locate and delete the entry:
    InstallSource = "%User Temp%"
49. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico"
50. Again In the right panel, locate and delete the entry:
    DisplayName = "Yontoo 1.10.02"
51. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.10.02"
52. Again In the right panel, locate and delete the entry:
    Publisher = "Yontoo LLC"
53. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://www.{BLOCKED}o.com"
54. Again In the right panel, locate and delete the entry:
    Contact = "support@yontoo.com"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tarma Installer>Products>{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
56. In the right panel, locate and delete the entry:
    TizPath = "%User Temp%\YontooSetup-S.exe"
57. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Zones>3
3. In the right panel, locate the registry value:
   1609 = "0"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   1609 = "1"
5. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\offconfig.temp
   • %User Temp%\idlimage.temp
   • %User Temp%\tmp1.tmp
   • %User Temp%\tmp2.tmp
   • %User Temp%\tmp3.tmp
   • %User Temp%\tmp4.tmp
   • %User Temp%\tmp5.tmp
   • %User Temp%\tmp6.tmp
   • %User Temp%\tmp7.tmp
   • %User Temp%\tmp8.tmp
   • %User Temp%\tmp9.tmp
   • %User Temp%\tmpA.tmp
   • %User Temp%\tmpB.tmp
   • %User Temp%\ezLooker-S-Setup_Suite1.exe
   • %User Temp%\tmpC.tmp
   • %User Temp%\tmpD.tmp
   • %User Temp%\playbryte_installer.exe
   • %User Temp%\PricePeepInstaller.exe
   • %User Temp%\ezLooker-S-Setup_Suite1-0308.exe
   • %User Temp%\3163F693.dat
   • %User Temp%\3163F693\_Setup.dll
   • %User Temp%\3163F693\Setup.ico
   • %User Temp%\3163F693\x86\regsvr32.exe
   • %User Temp%\3163F693\x64\regsvr32.exe
   • %User Temp%\YontooSetup-S.exe._tm
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat
   • %User Temp%\YontooSetup-S-074C.exe
   • %User Temp%\48A7B44E.dat
   • %User Temp%\48A7B44E\_Setup.dll
   • %User Temp%\48A7B44E\Setup.ico
   • %User Temp%\48A7B44E\_Setupx.dll
   • %User Temp%\48A7B44E\x86\regsvr32.exe
   • %User Temp%\48A7B44E\x64\regsvr32.exe
   • %User Temp%\7za.exe._tm
   • %User Temp%\sqlite3.exe._tm
   • %User Temp%\YontooIEClient.dll._tm
   • %User Temp%\InstallHandler.txt.tmp
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
   • %Program Files%\Yontoo\YontooIEClient.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\offconfig.temp
   • %User Temp%\idlimage.temp
   • %User Temp%\tmp1.tmp
   • %User Temp%\tmp2.tmp
   • %User Temp%\tmp3.tmp
   • %User Temp%\tmp4.tmp
   • %User Temp%\tmp5.tmp
   • %User Temp%\tmp6.tmp
   • %User Temp%\tmp7.tmp
   • %User Temp%\tmp8.tmp
   • %User Temp%\tmp9.tmp
   • %User Temp%\tmpA.tmp
   • %User Temp%\tmpB.tmp
   • %User Temp%\ezLooker-S-Setup_Suite1.exe
   • %User Temp%\tmpC.tmp
   • %User Temp%\tmpD.tmp
   • %User Temp%\playbryte_installer.exe
   • %User Temp%\PricePeepInstaller.exe
   • %User Temp%\ezLooker-S-Setup_Suite1-0308.exe
   • %User Temp%\3163F693.dat
   • %User Temp%\3163F693\_Setup.dll
   • %User Temp%\3163F693\Setup.ico
   • %User Temp%\3163F693\x86\regsvr32.exe
   • %User Temp%\3163F693\x64\regsvr32.exe
   • %User Temp%\YontooSetup-S.exe._tm
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat
   • %User Temp%\YontooSetup-S-074C.exe
   • %User Temp%\48A7B44E.dat
   • %User Temp%\48A7B44E\_Setup.dll
   • %User Temp%\48A7B44E\Setup.ico
   • %User Temp%\48A7B44E\_Setupx.dll
   • %User Temp%\48A7B44E\x86\regsvr32.exe
   • %User Temp%\48A7B44E\x64\regsvr32.exe
   • %User Temp%\7za.exe._tm
   • %User Temp%\sqlite3.exe._tm
   • %User Temp%\YontooIEClient.dll._tm
   • %User Temp%\InstallHandler.txt.tmp
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
   • %Program Files%\Yontoo\YontooIEClient.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\3163F693
   • %User Profile%\Application Data\Tarma Installer
   • %User Profile%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache
   • %User Temp%\3163F693\x86
   • %User Temp%\3163F693\x64
   • %User Temp%\48A7B44E
   • %User Profile%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Cache
   • %User Temp%\48A7B44E\x86
   • %User Temp%\48A7B44E\x64
   • %Program Files%\Yontoo
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\3163F693
   • %User Profile%\Application Data\Tarma Installer
   • %User Profile%\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}
   • %User Profile%\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache
   • %User Temp%\3163F693\x86
   • %User Temp%\3163F693\x64
   • %User Temp%\48A7B44E
   • %User Profile%\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
   • %User Profile%\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Cache
   • %User Temp%\48A7B44E\x86
   • %User Temp%\48A7B44E\x64
   • %Program Files%\Yontoo