TROJ_SPNV.03CG14

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Google>Chrome>Extensions
3. Still in the left panel, locate and delete the key:
   ahnenihgffnpifphegcnihemnejoigeo
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
5. Still in the left panel, locate and delete the key:
   Adobe Flash Players 12.0_is1
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Ext>Settings
7. Still in the left panel, locate and delete the key:
   {D0123838-675F-43DC-9D4C-58498D4D84C9}
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies
9. Still in the left panel, locate and delete the key:
   Ext
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext
11. Still in the left panel, locate and delete the key:
    CLSID
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
13. Still in the left panel, locate and delete the key:
    {D0123838-675F-43DC-9D4C-58498D4D84C9}
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D0123838-675F-43DC-9D4C-58498D4D84C9}
15. Still in the left panel, locate and delete the key:
    Programmable
16. Again Still in the left panel, locate and delete the key:
    InprocServer32
17. Again Still in the left panel, locate and delete the key:
    TypeLib
18. Again Still in the left panel, locate and delete the key:
    Version
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
20. Still in the left panel, locate and delete the key:
    {36EE8A25-52C6-4E01-9925-ED02C59F8016}
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{36EE8A25-52C6-4E01-9925-ED02C59F8016}
22. Still in the left panel, locate and delete the key:
    1.0
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{36EE8A25-52C6-4E01-9925-ED02C59F8016}>1.0
24. Still in the left panel, locate and delete the key:
    FLAGS
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{36EE8A25-52C6-4E01-9925-ED02C59F8016}>1.0>0
26. Still in the left panel, locate and delete the key:
    win32
27. Again Still in the left panel, locate and delete the key:
    HELPDIR
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
29. Still in the left panel, locate and delete the key:
    {2D01F487-C6A8-4292-8B3E-5F6DF7CC2459}
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2D01F487-C6A8-4292-8B3E-5F6DF7CC2459}
31. Still in the left panel, locate and delete the key:
    ProxyStubClsid
32. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
33. Again Still in the left panel, locate and delete the key:
    TypeLib
34. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions>ahnenihgffnpifphegcnihemnejoigeo
3. In the right panel, locate and delete the entry:
   Path = "%Program Files%\Adobe Flash Players 12.0\adobeflashplayer-sk.crx"
4. Again In the right panel, locate and delete the entry:
   Version = "12.0"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>Adobe Flash Players 12.0_is1
6. In the right panel, locate and delete the entry:
   Inno Setup: Setup Version = "5.5.4 (u)"
7. Again In the right panel, locate and delete the entry:
   Inno Setup: App Path = "%Program Files%\Adobe Flash Players 12.0"
8. Again In the right panel, locate and delete the entry:
   InstallLocation = "%Program Files%\Adobe Flash Players 12.0"
9. Again In the right panel, locate and delete the entry:
   Inno Setup: Icon Group = "Adobe Flash Players 12.0"
10. Again In the right panel, locate and delete the entry:
    Inno Setup: User = "Wilbert"
11. Again In the right panel, locate and delete the entry:
    Inno Setup: Language = "english"
12. Again In the right panel, locate and delete the entry:
    DisplayName = "Adobe Flash Players 12.0"
13. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\Adobe Flash Players 12.0\unins000.exe "
14. Again In the right panel, locate and delete the entry:
    QuietUninstallString = "%Program Files%\Adobe Flash Players 12.0\unins000.exe /SILENT"
15. Again In the right panel, locate and delete the entry:
    Publisher = "Adobe Flash Players 12.0"
16. Again In the right panel, locate and delete the entry:
    NoModify = "1"
17. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
18. Again In the right panel, locate and delete the entry:
    InstallDate = "20140224"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{D0123838-675F-43DC-9D4C-58498D4D84C9}
20. In the right panel, locate and delete the entry:
    NoExplorer = "1"
21. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Ext>Settings>{D0123838-675F-43DC-9D4C-58498D4D84C9}
22. In the right panel, locate and delete the entry:
    Flags = "19"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext>CLSID
24. In the right panel, locate and delete the entry:
    {D0123838-675F-43DC-9D4C-58498D4D84C9} = "1"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D0123838-675F-43DC-9D4C-58498D4D84C9}>InprocServer32
26. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2D01F487-C6A8-4292-8B3E-5F6DF7CC2459}>TypeLib
28. In the right panel, locate and delete the entry:
    Version = "1.0"
29. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\is-hdo2p.tmp\{malware file name}.tmp
   • %User Temp%\is-HS32B.tmp\_isetup\_shfoldr.dll
   • %Program Files%\Adobe Flash Players 12.0\unins000.dat
   • %Program Files%\Adobe Flash Players 12.0\is-00OQL.tmp
   • %Program Files%\Adobe Flash Players 12.0\is-AOFOE.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x86\is-6ST2L.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x86\is-NLD01.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x86\is-RE761.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x64\is-FT74D.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x64\is-VEVTG.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x64\is-9J117.tmp
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\is-hdo2p.tmp\{malware file name}.tmp
   • %User Temp%\is-HS32B.tmp\_isetup\_shfoldr.dll
   • %Program Files%\Adobe Flash Players 12.0\unins000.dat
   • %Program Files%\Adobe Flash Players 12.0\is-00OQL.tmp
   • %Program Files%\Adobe Flash Players 12.0\is-AOFOE.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x86\is-6ST2L.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x86\is-NLD01.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x86\is-RE761.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x64\is-FT74D.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x64\is-VEVTG.tmp
   • %Program Files%\Adobe Flash Players 12.0\IE\x64\is-9J117.tmp
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\is-HDO2P.tmp
   • %User Temp%\is-HS32B.tmp
   • %User Temp%\is-HS32B.tmp\_isetup
   • %Program Files%\Adobe Flash Players 12.0
   • %Program Files%\Adobe Flash Players 12.0\IE
   • %Program Files%\Adobe Flash Players 12.0\IE\x86
   • %Program Files%\Adobe Flash Players 12.0\IE\x64
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\is-HDO2P.tmp
   • %User Temp%\is-HS32B.tmp
   • %User Temp%\is-HS32B.tmp\_isetup
   • %Program Files%\Adobe Flash Players 12.0
   • %Program Files%\Adobe Flash Players 12.0\IE
   • %Program Files%\Adobe Flash Players 12.0\IE\x86
   • %Program Files%\Adobe Flash Players 12.0\IE\x64