TROJ_BADUR.NJE

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>ClientState
3. Still in the left panel, locate and delete the key:
   {8A69D345-D564-463C-AFF1-A69D9E530F96}
4. Again Still in the left panel, locate and delete the key:
   {4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Google
6. Still in the left panel, locate and delete the key:
   Update
7. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Group Policy Objects
8. Still in the left panel, locate and delete the key:
   {8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}User
9. Again Still in the left panel, locate and delete the key:
   {8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Group Policy Objects>{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine>Software>Policies>Google
11. Still in the left panel, locate and delete the key:
    Chrome
12. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software
13. Still in the left panel, locate and delete the key:
    RegisteredApplicationsEx
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}
15. Still in the left panel, locate and delete the key:
    _40030ae4
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}
17. Still in the left panel, locate and delete the key:
    _40030ae4
18. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
19. Still in the left panel, locate and delete the key:
    eae10f9d
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
21. Still in the left panel, locate and delete the key:
    eae10f9d
22. Again Still in the left panel, locate and delete the key:
    00000000
23. Again Still in the left panel, locate and delete the key:
    00000000
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE
25. Still in the left panel, locate and delete the key:
    {77D46E27-0E41-4478-87A6-AABE6FBCF252}
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
27. Still in the left panel, locate and delete the key:
    {5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
28. Again Still in the left panel, locate and delete the key:
    {3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
29. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>ClientState>{8A69D345-D564-463C-AFF1-A69D9E530F96}
3. In the right panel, locate and delete the entry:
   ap = "2.0-dev-multi-chrome"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>ClientState>{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
5. In the right panel, locate and delete the entry:
   ap = "-dev-multi-chrome"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Google>Update
7. In the right panel, locate and delete the entry:
   UpdateDefault = "0"
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Group Policy Objects>{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine>Software>Policies>Google>Chrome
9. In the right panel, locate and delete the entry:
   MetricsReportingEnabled = "0"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>RegisteredApplicationsEx
11. In the right panel, locate and delete the entry:
    6edbe30d93ca018c3edfd72d9fb388b9 = "1"
12. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
13. In the right panel, locate and delete the entry:
    date = "1403159992"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4
15. In the right panel, locate and delete the entry:
    date = "1403159992"
16. Again In the right panel, locate and delete the entry:
    data.0 = "3VMhbySOrDUO6WYSUMjezqCPaV3GY7RVXlp/lwKPTKsVJaVN0"
17. Again In the right panel, locate and delete the entry:
    data.0 = "3VMhbySOrDUO6WYSUMjezqCPaV3GY7RVXlp/lwKPTKsVJaVN0"
18. Again In the right panel, locate and delete the entry:
    data.1 = "IQ0RLif/YUBU+bcdefTdLStKRzCGQSNGN0zbwKe8Z+TxJJLS/e"
19. Again In the right panel, locate and delete the entry:
    data.1 = "IQ0RLif/YUBU+bcdefTdLStKRzCGQSNGN0zbwKe8Z+TxJJLS/e"
20. Again In the right panel, locate and delete the entry:
    usr.0 = "JHVg1xXZTVNPRJLFHw"
21. Again In the right panel, locate and delete the entry:
    usr.0 = "JHVg1xXZTVNPRJLFHw"
22. Again In the right panel, locate and delete the entry:
    usr.1 = "j++ACGcdefABCDWYSU"
23. Again In the right panel, locate and delete the entry:
    usr.1 = "j++ACGcdefABCDWYSU"
24. Again In the right panel, locate and delete the entry:
    version = "15761"
25. Again In the right panel, locate and delete the entry:
    uuid = "25fb90de-76df21b9-68ad0fd0"
26. Again In the right panel, locate and delete the entry:
    uuid = "25fb90de-76df21b9-68ad0fd0"
27. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>eae10f9d
28. In the right panel, locate and delete the entry:
    a2e3b941 = "///%"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>eae10f9d
30. In the right panel, locate and delete the entry:
    a2e3b941 = "///%"
31. Again In the right panel, locate and delete the entry:
    bbf88800 = "///%"
32. Again In the right panel, locate and delete the entry:
    bbf88800 = "///%"
33. Again In the right panel, locate and delete the entry:
    state = "0"
34. Again In the right panel, locate and delete the entry:
    a1dcff5b = "V/////%%"
35. Again In the right panel, locate and delete the entry:
    a1dcff5b = "V/////%%"
36. Again In the right panel, locate and delete the entry:
    340d3099 = "/P////%%"
37. Again In the right panel, locate and delete the entry:
    340d3099 = "/P////%%"
38. Again In the right panel, locate and delete the entry:
    0e93c3f3 = "///%"
39. Again In the right panel, locate and delete the entry:
    0e93c3f3 = "///%"
40. Again In the right panel, locate and delete the entry:
    0c230bcb = "///%"
41. Again In the right panel, locate and delete the entry:
    0c230bcb = "///%"
42. Again In the right panel, locate and delete the entry:
    27ddcf6f = "///%"
43. Again In the right panel, locate and delete the entry:
    27ddcf6f = "///%"
44. Again In the right panel, locate and delete the entry:
    414bc593 = "///%"
45. Again In the right panel, locate and delete the entry:
    414bc593 = "///%"
46. Again In the right panel, locate and delete the entry:
    f0bf0bde = "///%"
47. Again In the right panel, locate and delete the entry:
    f0bf0bde = "///%"
48. Again In the right panel, locate and delete the entry:
    c99a5f5c = "///%"
49. Again In the right panel, locate and delete the entry:
    c99a5f5c = "///%"
50. Again In the right panel, locate and delete the entry:
    72758a5d = "///%"
51. Again In the right panel, locate and delete the entry:
    72758a5d = "///%"
52. Again In the right panel, locate and delete the entry:
    e46c271e = "///%"
53. Again In the right panel, locate and delete the entry:
    e46c271e = "///%"
54. Again In the right panel, locate and delete the entry:
    7f69fa1f = "///%"
55. Again In the right panel, locate and delete the entry:
    7f69fa1f = "///%"
56. Again In the right panel, locate and delete the entry:
    3c09c42b = "///%"
57. Again In the right panel, locate and delete the entry:
    3c09c42b = "///%"
58. Again In the right panel, locate and delete the entry:
    7367429f = "///%"
59. Again In the right panel, locate and delete the entry:
    7367429f = "///%"
60. Again In the right panel, locate and delete the entry:
    0dc3ee96 = "/P////%%"
61. Again In the right panel, locate and delete the entry:
    0dc3ee96 = "/P////%%"
62. Again In the right panel, locate and delete the entry:
    d1abcdb6 = "///%"
63. Again In the right panel, locate and delete the entry:
    d1abcdb6 = "///%"
64. Again In the right panel, locate and delete the entry:
    38583bc3 = "N//e/Ct/Vx/l/C/////%"
65. Again In the right panel, locate and delete the entry:
    38583bc3 = "N//e/Ct/Vx/l/C/////%"
66. Again In the right panel, locate and delete the entry:
    c24899a6 = "MP/f/CF/Mx/l/C/////%"
67. Again In the right panel, locate and delete the entry:
    c24899a6 = "MP/f/CF/Mx/l/C/////%"
68. Again In the right panel, locate and delete the entry:
    f1f24e29 = "Vl/l/C/////%"
69. Again In the right panel, locate and delete the entry:
    f1f24e29 = "Vl/l/C/////%"
70. Again In the right panel, locate and delete the entry:
    c5705860 = "Vx////%%"
71. Again In the right panel, locate and delete the entry:
    c5705860 = "Vx////%%"
72. Again In the right panel, locate and delete the entry:
    a0743acc = "N/////%%"
73. Again In the right panel, locate and delete the entry:
    a0743acc = "N/////%%"
74. Again In the right panel, locate and delete the entry:
    c6c5dd44 = "V/////%%"
75. Again In the right panel, locate and delete the entry:
    c6c5dd44 = "V/////%%"
76. Again In the right panel, locate and delete the entry:
    1520c6f1 = "V/////%%"
77. Again In the right panel, locate and delete the entry:
    1520c6f1 = "V/////%%"
78. Again In the right panel, locate and delete the entry:
    2d71d5ab = "V/////%%"
79. Again In the right panel, locate and delete the entry:
    2d71d5ab = "V/////%%"
80. Again In the right panel, locate and delete the entry:
    8b9e4cbc = "V/////%%"
81. Again In the right panel, locate and delete the entry:
    8b9e4cbc = "V/////%%"
82. Again In the right panel, locate and delete the entry:
    fe94ce1e = "V/////%%"
83. Again In the right panel, locate and delete the entry:
    fe94ce1e = "V/////%%"
84. Again In the right panel, locate and delete the entry:
    587b5709 = "V/////%%"
85. Again In the right panel, locate and delete the entry:
    587b5709 = "V/////%%"
86. Again In the right panel, locate and delete the entry:
    lrts = "0"
87. Again In the right panel, locate and delete the entry:
    lrts = "0"
88. Again In the right panel, locate and delete the entry:
    mode = "f"
89. Again In the right panel, locate and delete the entry:
    mode = "f"
90. Again In the right panel, locate and delete the entry:
    svn = "Supporter"
91. Again In the right panel, locate and delete the entry:
    svi = "0"
92. Again In the right panel, locate and delete the entry:
    svt = "53a285b9"
93. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>AppDataLow>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>00000000
94. In the right panel, locate and delete the entry:
    370856c7 = "{random characters}"
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>{5F189DF5-2D05-472B-9091-84D9848AE48B}>_40030ae4>00000000
96. In the right panel, locate and delete the entry:
    370856c7 = "{random characters}"
97. Again In the right panel, locate and delete the entry:
    3efeb33e = "{random characters}"
98. Again In the right panel, locate and delete the entry:
    3efeb33e = "{random characters}"
99. Again In the right panel, locate and delete the entry:
    060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"
100. Again In the right panel, locate and delete the entry:
     060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"
101. Again In the right panel, locate and delete the entry:
     iiid = "1"
102. Again In the right panel, locate and delete the entry:
     iiid = "1"
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Windows
104. In the right panel, locate and delete the entry:
     LoadAppInit_DLLs = "1"
105. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>{77D46E27-0E41-4478-87A6-AABE6FBCF252}
106. In the right panel, locate and delete the entry:
     40030ae4 = "%Program Files%\Supporter\Supporter.dll"
107. Again In the right panel, locate and delete the entry:
     dlpath = "%Program Files%\suppor~1\suppor~1.dll"
108. Again In the right panel, locate and delete the entry:
     svpath = "%Program Files%\suppor~1\SupporterSvc.dll"
109. Again In the right panel, locate and delete the entry:
     Install_Dir = "%Program Files%\Supporter"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
111. In the right panel, locate and delete the entry:
     UninstallString = "%System%\RUNDLL32.EXE %Program Files%\SUPPOR~1\SUPPOR~1.DLL,_uninstall /un"
112. Again In the right panel, locate and delete the entry:
     QuietUninstallString = "{random characters}"
113. Again In the right panel, locate and delete the entry:
     NoModify = "1"
114. Again In the right panel, locate and delete the entry:
     NoRepair = "1"
115. Again In the right panel, locate and delete the entry:
     Publisher = "Costmin"
116. Again In the right panel, locate and delete the entry:
     InstallDate = "20140618"
117. Again In the right panel, locate and delete the entry:
     DisplayName = "Supporter 1.80"
118. Again In the right panel, locate and delete the entry:
     n = "1"
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
120. In the right panel, locate and delete the entry:
     n = "1"
121. Again In the right panel, locate and delete the entry:
     dbaf3ce3 = "/P////%%"
122. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Windows
3. In the right panel, locate the registry value:
   AppInit_DLLs = "%Program Files%\suppor~1\suppor~1.dll"
4. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\pl33171017.fyt
   • %User Temp%\294823_.exe
   • %User Temp%\18be6784_.exe
   • %User Temp%/3f03101c/MENodU.dat
   • %User Temp%/3f03101c/MENodU.exe
   • %User Temp%/3f03101c/3osXy.dll
   • %User Temp%/3f03101c/8pvVL.x64.dll
   • %User Temp%/3f03101c/8pvVL.tlb
   • %User Temp%/3f03101c/8pvVL.dll
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/content/bg.js
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/install.rdf
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/chrome.manifest
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/bootstrap.js
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/lsdb.js
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/content.js
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/manifest.json
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/background.html
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/iNPF_4k.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %System%\GroupPolicy\Machine\Registry.pol
   • %Program Files%\CostMin\8pvVL.dll
   • %Program Files%\CostMin\8pvVL.tlb
   • %Program Files%\CostMin\8pvVL.dat
   • %User Temp%\tf00294823.dll
   • %Program Files%\Supporter\Supporter.dll
   • %Program Files%\suppor~1\SupporterSvc.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\pl33171017.fyt
   • %User Temp%\294823_.exe
   • %User Temp%\18be6784_.exe
   • %User Temp%/3f03101c/MENodU.dat
   • %User Temp%/3f03101c/MENodU.exe
   • %User Temp%/3f03101c/3osXy.dll
   • %User Temp%/3f03101c/8pvVL.x64.dll
   • %User Temp%/3f03101c/8pvVL.tlb
   • %User Temp%/3f03101c/8pvVL.dll
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/content/bg.js
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/install.rdf
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/chrome.manifest
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/bootstrap.js
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/lsdb.js
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/content.js
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/manifest.json
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/background.html
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/iNPF_4k.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
   • %System%\GroupPolicy\Machine\Registry.pol
   • %Program Files%\CostMin\8pvVL.dll
   • %Program Files%\CostMin\8pvVL.tlb
   • %Program Files%\CostMin\8pvVL.dat
   • %User Temp%\tf00294823.dll
   • %Program Files%\Supporter\Supporter.dll
   • %Program Files%\suppor~1\SupporterSvc.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%/3f03101c
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/content
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp
   • %System Root%\Documents and Settings\Administrator
   • %Application Data%\Google
   • %Application Data%\Google\Chrome
   • %Application Data%\Google\Chrome\User Data
   • %Application Data%\Google\Chrome\User Data\Default
   • %Application Data%\Google\Chrome\User Data\Default\Extensions
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %System Root%\Documents and Settings\ASPNET
   • %System Root%\Documents and Settings\Guest
   • %System Root%\Documents and Settings\HelpAssistant
   • %System Root%\Documents and Settings\SUPPORT_388945a0
   • %Application Data%\Comodo
   • %Application Data%\Comodo\Dragon
   • %Application Data%\Comodo\Dragon\User Data
   • %Application Data%\Comodo\Dragon\User Data\Default
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %Application Data%\Google\Chrome SxS
   • %Application Data%\Google\Chrome SxS\User Data
   • %Application Data%\Google\Chrome SxS\User Data\Default
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %Application Data%\Torch
   • %Application Data%\Torch\User Data
   • %Application Data%\Torch\User Data\Default
   • %Application Data%\Torch\User Data\Default\Extensions
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %Application Data%\Chromatic Browser
   • %Application Data%\Chromatic Browser\User Data
   • %Application Data%\Chromatic Browser\User Data\Default
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %System%\GroupPolicy
   • %System%\GroupPolicy\Machine
   • %System%\GroupPolicy\User
   • %Program Files%\CostMin
   • %Program Files%\Supporter
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%/3f03101c
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk
   • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/content
   • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp
   • %System Root%\Documents and Settings\Administrator
   • %Application Data%\Google
   • %Application Data%\Google\Chrome
   • %Application Data%\Google\Chrome\User Data
   • %Application Data%\Google\Chrome\User Data\Default
   • %Application Data%\Google\Chrome\User Data\Default\Extensions
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %System Root%\Documents and Settings\ASPNET
   • %System Root%\Documents and Settings\Guest
   • %System Root%\Documents and Settings\HelpAssistant
   • %System Root%\Documents and Settings\SUPPORT_388945a0
   • %Application Data%\Comodo
   • %Application Data%\Comodo\Dragon
   • %Application Data%\Comodo\Dragon\User Data
   • %Application Data%\Comodo\Dragon\User Data\Default
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %Application Data%\Google\Chrome SxS
   • %Application Data%\Google\Chrome SxS\User Data
   • %Application Data%\Google\Chrome SxS\User Data\Default
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %Application Data%\Torch
   • %Application Data%\Torch\User Data
   • %Application Data%\Torch\User Data\Default
   • %Application Data%\Torch\User Data\Default\Extensions
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %Application Data%\Chromatic Browser
   • %Application Data%\Chromatic Browser\User Data
   • %Application Data%\Chromatic Browser\User Data\Default
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
   • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
   • %System%\GroupPolicy
   • %System%\GroupPolicy\Machine
   • %System%\GroupPolicy\User
   • %Program Files%\CostMin
   • %Program Files%\Supporter