TROJ_DROPPE.TU

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
3. Still in the left panel, locate and delete the key:
   Urlnav.Nav.1
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Urlnav.Nav.1
5. Still in the left panel, locate and delete the key:
   CLSID
6. Again Still in the left panel, locate and delete the key:
   Urlnav.Nav
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Urlnav.Nav
8. Still in the left panel, locate and delete the key:
   CLSID
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
10. Still in the left panel, locate and delete the key:
    {9A4DDA61-1D3A-49B7-9849-DAC6CD30A393}
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9A4DDA61-1D3A-49B7-9849-DAC6CD30A393}
12. Still in the left panel, locate and delete the key:
    ProgID
13. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
14. Again Still in the left panel, locate and delete the key:
    InprocServer32
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
16. Still in the left panel, locate and delete the key:
    {40195CA5-4EA4-4B10-88B3-5659A0A5310B}
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{40195CA5-4EA4-4B10-88B3-5659A0A5310B}
18. Still in the left panel, locate and delete the key:
    1.0
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{40195CA5-4EA4-4B10-88B3-5659A0A5310B}>1.0
20. Still in the left panel, locate and delete the key:
    FLAGS
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{40195CA5-4EA4-4B10-88B3-5659A0A5310B}>1.0>0
22. Still in the left panel, locate and delete the key:
    win32
23. Again Still in the left panel, locate and delete the key:
    HELPDIR
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
25. Still in the left panel, locate and delete the key:
    {ED2676C8-F22C-4E60-9812-E2851B2AD210}
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{ED2676C8-F22C-4E60-9812-E2851B2AD210}
27. Still in the left panel, locate and delete the key:
    ProxyStubClsid
28. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
29. Again Still in the left panel, locate and delete the key:
    TypeLib
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MicroPlugins
31. Still in the left panel, locate and delete the key:
    Common
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
33. Still in the left panel, locate and delete the key:
    ContentMatch
34. Again Still in the left panel, locate and delete the key:
    Urladv.Adv.1
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Urladv.Adv.1
36. Still in the left panel, locate and delete the key:
    CLSID
37. Again Still in the left panel, locate and delete the key:
    Urladv.Adv
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Urladv.Adv
39. Still in the left panel, locate and delete the key:
    CLSID
40. Again Still in the left panel, locate and delete the key:
    CurVer
41. Again Still in the left panel, locate and delete the key:
    {0EE16FA9-E135-43B5-8236-A0CC75F60BB6}
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}
43. Still in the left panel, locate and delete the key:
    ProgID
44. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
45. Again Still in the left panel, locate and delete the key:
    Programmable
46. Again Still in the left panel, locate and delete the key:
    InprocServer32
47. Again Still in the left panel, locate and delete the key:
    TypeLib
48. Again Still in the left panel, locate and delete the key:
    {8003D2E5-F50C-4DC2-9670-C44ABCABCE02}
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}
50. Still in the left panel, locate and delete the key:
    1.0
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}>1.0
52. Still in the left panel, locate and delete the key:
    FLAGS
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}>1.0>0
54. Still in the left panel, locate and delete the key:
    win32
55. Again Still in the left panel, locate and delete the key:
    HELPDIR
56. Again Still in the left panel, locate and delete the key:
    {649FBF2D-FE00-44E6-8A98-B4350960D943}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{649FBF2D-FE00-44E6-8A98-B4350960D943}
58. Still in the left panel, locate and delete the key:
    ProxyStubClsid
59. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
60. Again Still in the left panel, locate and delete the key:
    TypeLib
61. Again Still in the left panel, locate and delete the key:
    Microsoft.IE
62. Again Still in the left panel, locate and delete the key:
    NewCosoMediumPop.PopCoso.1
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NewCosoMediumPop.PopCoso.1
64. Still in the left panel, locate and delete the key:
    CLSID
65. Again Still in the left panel, locate and delete the key:
    NewCosoMediumPop.PopCoso
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NewCosoMediumPop.PopCoso
67. Still in the left panel, locate and delete the key:
    CLSID
68. Again Still in the left panel, locate and delete the key:
    CurVer
69. Again Still in the left panel, locate and delete the key:
    {CDE9EB54-A08E-4570-B748-13F5DDB5781C}
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{CDE9EB54-A08E-4570-B748-13F5DDB5781C}
71. Still in the left panel, locate and delete the key:
    ProgID
72. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
73. Again Still in the left panel, locate and delete the key:
    Programmable
74. Again Still in the left panel, locate and delete the key:
    InprocServer32
75. Again Still in the left panel, locate and delete the key:
    TypeLib
76. Again Still in the left panel, locate and delete the key:
    NexyAdPopup.AYLogic.1
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NexyAdPopup.AYLogic.1
78. Still in the left panel, locate and delete the key:
    CLSID
79. Again Still in the left panel, locate and delete the key:
    NexyAdPopup.AYLogic
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NexyAdPopup.AYLogic
81. Still in the left panel, locate and delete the key:
    CLSID
82. Again Still in the left panel, locate and delete the key:
    CurVer
83. Again Still in the left panel, locate and delete the key:
    {11F09AFE-75AD-4E52-AB43-E09E9351CE17}
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{11F09AFE-75AD-4E52-AB43-E09E9351CE17}
85. Still in the left panel, locate and delete the key:
    ProgID
86. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
87. Again Still in the left panel, locate and delete the key:
    Programmable
88. Again Still in the left panel, locate and delete the key:
    InprocServer32
89. Again Still in the left panel, locate and delete the key:
    TypeLib
90. Again Still in the left panel, locate and delete the key:
    {DE2267BD-B163-407F-9E8D-6ADEC771E7AB}
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}
92. Still in the left panel, locate and delete the key:
    1.0
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}>1.0
94. Still in the left panel, locate and delete the key:
    FLAGS
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}>1.0>0
96. Still in the left panel, locate and delete the key:
    win32
97. Again Still in the left panel, locate and delete the key:
    HELPDIR
98. Again Still in the left panel, locate and delete the key:
    {0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}
99. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}
100. Still in the left panel, locate and delete the key:
     ProxyStubClsid
101. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
102. Again Still in the left panel, locate and delete the key:
     TypeLib
103. Again Still in the left panel, locate and delete the key:
     {50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}
105. Still in the left panel, locate and delete the key:
     ProxyStubClsid
106. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
107. Again Still in the left panel, locate and delete the key:
     TypeLib
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE
109. Still in the left panel, locate and delete the key:
     cpush
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>cpush
111. Still in the left panel, locate and delete the key:
     update
112. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>CLSID>{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
113. Still in the left panel, locate and delete the key:
     InprocServer32
114. Again Still in the left panel, locate and delete the key:
     BMY
115. Again Still in the left panel, locate and delete the key:
     Microsoft.PubIE
116. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
3. In the right panel, locate and delete the entry:
   Error Dlg Displayed On Every Error = "no"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>New Windows
5. In the right panel, locate and delete the entry:
   PopupMgr = "no"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9A4DDA61-1D3A-49B7-9849-DAC6CD30A393}>InprocServer32
7. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{ED2676C8-F22C-4E60-9812-E2851B2AD210}>TypeLib
9. In the right panel, locate and delete the entry:
   Version = "1.0"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MicroPlugins>Common
11. In the right panel, locate and delete the entry:
    param = "sid
12. Again In the right panel, locate and delete the entry:
    size = "1fa586"
13. Again In the right panel, locate and delete the entry:
    tlen = "2d99ef"
14. Again In the right panel, locate and delete the entry:
    backup = "1a66d"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>ContentMatch
16. In the right panel, locate and delete the entry:
    DisplayName = "Adsense based PopAd"
17. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\Common Files\PushWare\Uninst.exe"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}>InprocServer32
19. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{649FBF2D-FE00-44E6-8A98-B4350960D943}>TypeLib
21. In the right panel, locate and delete the entry:
    Version = "1.0"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{CDE9EB54-A08E-4570-B748-13F5DDB5781C}>InprocServer32
23. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{11F09AFE-75AD-4E52-AB43-E09E9351CE17}>InprocServer32
25. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}>TypeLib
27. In the right panel, locate and delete the entry:
    Version = "1.0"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}>TypeLib
29. In the right panel, locate and delete the entry:
    Version = "1.0"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>cpush>update
31. In the right panel, locate and delete the entry:
    Ad_Version = "1,2,5,0"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>BMY
33. In the right panel, locate and delete the entry:
    HidePop = "0"
34. Again In the right panel, locate and delete the entry:
    SifuNav = "0"
35. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>AdvancedOptions>BROWSE>SCRIPT_ERROR_CACHE
3. In the right panel, locate the registry value:
   CheckedValue = "yes"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   CheckedValue = "yes"
5. Again In the right panel, locate the registry value:
   DefaultValue = "yes"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
   DefaultValue = "no"
7. Again In the right panel, locate the registry value:
   UncheckedValue = "no"
8. Right-click on the value name and choose Modify. Change the value data of this entry to:
   UncheckedValue = "no"
9. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %System%\drivers\HideSys.sys
   • %Windows%\zkH\flist.bin
   • %Windows%\zkH\iets\ad25414.txt
   • %Windows%\zkH\hpad\ttserver.txt
   • %Windows%\zkH\ads\webndis.txt
   • %Windows%\zkH\First.txt
   • %Windows%\zkH\htvtcx.exe
   • %Windows%\zkH\ads\shock.txt
   • %Windows%\zkH\ads\webndis.exe
   • %Windows%\zkH\ads\urlnav.txt
   • %Windows%\zkH\ads\shock.exe
   • %Windows%\zkH\MiniIE.txt
   • %Windows%\zkH\ads\whitelist.txt
   • %Windows%\zkH\ads\whitelist.dat
   • %Windows%\zkH\ads\tray.txt
   • %Windows%\zkH\hpad\ttserver.exe
   • %Windows%\zkH\ads\urlnav.dll
   • %Windows%\zkH\MiniIE.exe
   • %Windows%\zkH\ads\tray.exe
   • %System%\drivers\WebNdis.sys
   • %User Temp%\nsn27.tmp
   • %Program Files%\Common Files\PushWare\Uninst.exe
   • %Program Files%\Common Files\PushWare\cpush.dll
   • %Windows%\zkH\ads\shock.dat
   • %Windows%\zkH\ads\shock.dll
   • %Windows%\he1p
   • %Windows%\zkH\hpad\configWord.cf
   • %Windows%\zkH\hpad\private.exe
   • %Windows%\zkH\ads\services.exe
   • %User Temp%\gnwfoda.txt
   • %User Temp%\lppzvfd.txt
   • %Windows%\zkH\iets\ad25414.exe
   • %User Temp%\cpgfapq.txt
   • %User Temp%\zfabzem.txt
   • %User Temp%\ngaqjgh.txt
   • %User Temp%\mzkwxcs.txt
   • %User Temp%\qrdabbi.txt
   • %User Temp%\mcmckiq.txt
   • %User Temp%\kpgsqji.txt
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %System%\drivers\HideSys.sys
   • %Windows%\zkH\flist.bin
   • %Windows%\zkH\iets\ad25414.txt
   • %Windows%\zkH\hpad\ttserver.txt
   • %Windows%\zkH\ads\webndis.txt
   • %Windows%\zkH\First.txt
   • %Windows%\zkH\htvtcx.exe
   • %Windows%\zkH\ads\shock.txt
   • %Windows%\zkH\ads\webndis.exe
   • %Windows%\zkH\ads\urlnav.txt
   • %Windows%\zkH\ads\shock.exe
   • %Windows%\zkH\MiniIE.txt
   • %Windows%\zkH\ads\whitelist.txt
   • %Windows%\zkH\ads\whitelist.dat
   • %Windows%\zkH\ads\tray.txt
   • %Windows%\zkH\hpad\ttserver.exe
   • %Windows%\zkH\ads\urlnav.dll
   • %Windows%\zkH\MiniIE.exe
   • %Windows%\zkH\ads\tray.exe
   • %System%\drivers\WebNdis.sys
   • %User Temp%\nsn27.tmp
   • %Program Files%\Common Files\PushWare\Uninst.exe
   • %Program Files%\Common Files\PushWare\cpush.dll
   • %Windows%\zkH\ads\shock.dat
   • %Windows%\zkH\ads\shock.dll
   • %Windows%\he1p
   • %Windows%\zkH\hpad\configWord.cf
   • %Windows%\zkH\hpad\private.exe
   • %Windows%\zkH\ads\services.exe
   • %User Temp%\gnwfoda.txt
   • %User Temp%\lppzvfd.txt
   • %Windows%\zkH\iets\ad25414.exe
   • %User Temp%\cpgfapq.txt
   • %User Temp%\zfabzem.txt
   • %User Temp%\ngaqjgh.txt
   • %User Temp%\mzkwxcs.txt
   • %User Temp%\qrdabbi.txt
   • %User Temp%\mcmckiq.txt
   • %User Temp%\kpgsqji.txt
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %Windows%\zkH
   • %Windows%\zkH\hpad
   • %Windows%\zkH\ads
   • %Windows%\zkH\iets
   • %Program Files%\Common Files\PushWare
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %Windows%\zkH
   • %Windows%\zkH\hpad
   • %Windows%\zkH\ads
   • %Windows%\zkH\iets
   • %Program Files%\Common Files\PushWare