ADW_VOPACKAGE

October 28, 2014

ALIASES:

[3.nsis]:RDN/Generic PUP.x!chl. (McAfee); Trojan.Win32.Generic!BT (Sunbelt)

PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

OVERALL RISK RATING:

REPORTED INFECTION:

SYSTEM IMPACT RATING:

INFORMATION EXPOSURE:

Threat Type: Adware
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

TECHNICAL DETAILS

File Size: 1,636,764 bytes

File Type: EXE

Memory Resident: No

Initial Samples Received Date: 14 Jul 2014

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This adware creates the following folders:

%System Root%\DOCUME~1
%System Root%\DOCUME~1\Wilbert
%User Profile%\LOCALS~1
%User Temp%\nsu3.tmp
%User Temp%\nsy9.tmp
%Program Files%\Convert Files for Free
%System Root%\Documents and Settings\Wilbert
%Program Files%\File Type Helper
%User Temp%\nsc25.tmp
%User Temp%\nsd34.tmp
%User Profile%\Application Data\VOPackage
%Start Menu%\Programs\VOPackage

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %User Profile% is a user's profile folder, where it usually is C:\Documents and Settings\{user name} on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name} on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This adware registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}

Other System Modifications

This adware deletes the following files:

%User Temp%\nsf1.tmp
%User Temp%\nsu3.tmp
%User Temp%\nst7.tmp
%User Temp%\nsy9.tmp
%User Temp%\nsc1F.tmp
%User Temp%\nsc25.tmp
%User Temp%\nso32.tmp
%User Temp%\nsd34.tmp

It adds the following registry keys:

HKEY_LOCAL_MACHINE\Software\Convert Files for Free

HKEY_LOCAL_MACHINE\Software\Convert Files for Free\
ConvertFilesforFree

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
Ext

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
Ext\CLSID

HKEY_LOCAL_MACHINE\Software\ZUpdater\
ConvertFilesforFreeUpdt.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Convert Files for Free

HKEY_LOCAL_MACHINE\Software\Convert Files for Free\
installed_success

HKEY_CLASSES_ROOT\ConvertFilesforFree.1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ConvertFilesforFree.1\CLSID

HKEY_CLASSES_ROOT\ConvertFilesforFree

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ConvertFilesforFree\CurVer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\VersionIndependentProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\Programmable

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\InprocServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\Implemented Categories

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\Implemented Categories\
{59fb2056-d625-48d0-a944-1a85b5ab2640}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\Version

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{22B58425-A384-436C-A334-BB9255664D10}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{22B58425-A384-436C-A334-BB9255664D10}\1.0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{22B58425-A384-436C-A334-BB9255664D10}\1.0\
FLAGS

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{22B58425-A384-436C-A334-BB9255664D10}\1.0\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{22B58425-A384-436C-A334-BB9255664D10}\1.0\
0\win32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{22B58425-A384-436C-A334-BB9255664D10}\1.0\
HELPDIR

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{951F4658-6461-46AD-AB13-F73E7FCBE6DB}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{951F4658-6461-46AD-AB13-F73E7FCBE6DB}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{951F4658-6461-46AD-AB13-F73E7FCBE6DB}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{951F4658-6461-46AD-AB13-F73E7FCBE6DB}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\File Type Helper

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Unknown\shell\opendlg\
command

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\App Paths\
FileTypeHelper.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
VOPackage

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free
Name = "Convert Files for Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free
Version = "8.25"

HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\
ConvertFilesforFree
app_id = "5A23FD7D951E47F3BF71EEBFDEA89FDE"

HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\
ConvertFilesforFree
Channel = "Installmonetize3"

HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\
ConvertFilesforFree
Root_domen = "www.convertfilesforfree.com/w"

HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\
ConvertFilesforFree
JS_Domen = "d1798l6lhp8h4d.cloudfront.net/w"

HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\
ConvertFilesforFree
Name_Main_build = "Convert Files for Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Ext
ListBox_Support_CLSID = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Ext\CLSID
{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB} = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\
ConvertFilesforFreeUpdt.exe
Version = "8.25"

HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\
ConvertFilesforFreeUpdt.exe
Folder = "%User Temp%"

HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\
ConvertFilesforFreeUpdt.exe
Name = "ConvertFilesforFreeUpdt"

HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\
ConvertFilesforFreeUpdt.exe
Url = "http://www.{BLOCKED}tfilesforfree.com/w/updater/u.php"

HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\
ConvertFilesforFreeUpdt.exe
app_id = "5A23FD7D951E47F3BF71EEBFDEA89FDE"

HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\
ConvertFilesforFreeUpdt.exe
ext_params = "&channel=Installmonetize3"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Convert Files for Free
DisplayName = "Convert Files for Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Convert Files for Free
UninstallString = "%Program Files%\Convert Files for Free\uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Convert Files for Free
DisplayIcon = "%Program Files%\Convert Files for Free\install.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Convert Files for Free
DisplayVersion = "8.25"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Convert Files for Free
URLInfoAbout = "http://www.{BLOCKED}tfilesforfree.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Convert Files for Free
Publisher = "Convert Files for Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\
installed_success
installed_success = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
NoExplorer = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{951F4658-6461-46AD-AB13-F73E7FCBE6DB}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\File Type Helper
old_openas = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\File Type Helper
old_opendlg = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
VOPackage
DisplayName = "Installer"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
VOPackage
UninstallString = "%User Profile%\VOPackage\uninstall.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
VOPackage
DisplayIcon = "%User Profile%\VOPackage\uninstall.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
VOPackage
DisplayVersion = "1.0.0.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
VOPackage
Source = "imz"

Dropping Routine

This adware drops the following files:

%User Temp%\nsu3.tmp\ConvertFilesforFree_8.25_Installmonetize3_release.exe
%User Temp%\nsu3.tmp\VOPackage.exe
%User Temp%\nsu3.tmp\registry.dll
%User Temp%\nsu3.tmp\manlib.dll
%User Temp%\nsu3.tmp\output.txt
%User Temp%\nsy9.tmp\System.dll
%User Temp%\nsy9.tmp\registry.dll
%User Temp%\nsy9.tmp\GetVersion.dll
%User Temp%\nsy9.tmp\inetc.dll
/END
%Program Files%\Convert Files for Free\install.ico
%Program Files%\Convert Files for Free\ConvertFilesforFree.dll
%User Temp%\nsy9.tmp\SimpleSC.dll
%User Temp%\nsy9.tmp\nsExec.dll
%Program Files%\Convert Files for Free\ConvertFilesforFreeUpdt.exe
%User Temp%\helper.exe
%Program Files%\Convert Files for Free\uninstall.exe
0
%Temp%\ConvertFilesforFreeUpdt_update.txt
%User Temp%\nss21.tmp
%Program Files%\File Type Helper\FileTypeHelper_assoc.7z
%User Temp%\nsc25.tmp\nsis7z.dll
%Program Files%\File Type Helper\Magnifier_64.ico
%Program Files%\File Type Helper\FileTypeHelper_assoc.exe
%Program Files%\File Type Helper\FileTypeHelper.exe
isAssoc.txt
%Program Files%\File Type Helper\uninstall.exe
%User Temp%\nsd34.tmp\System.dll
%User Temp%\nsd34.tmp\WmiInspector.dll
%User Temp%\nsd34.tmp\t1.dll
%User Temp%\nsd34.tmp\inetc.dll
%User Temp%\b
%User Temp%\nsd34.tmp\IpConfig.dll
%User Temp%\heu39T.nss
%User Profile%\VOPackage\Uninstall.exe
%Start Menu%\Programs\VOPackage\Configure.lnk

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.. %User Profile% is a user's profile folder, where it usually is C:\Documents and Settings\{user name} on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name} on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This adware connects to the following possibly malicious URL:

http://www.{BLOCKED}tfilesforfree.com
http://www.{BLOCKED}tfilesforfree.com/r?{random characters}
{BLOCKED}120.127
{BLOCKED}3.198.187

This report is generated via an automated analysis system.

SOLUTION

Minimum Scan Engine: 9.700

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Close all opened browser windows

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\Software
- Convert Files for Free

In HKEY_LOCAL_MACHINE\Software\Convert Files for Free
- ConvertFilesforFree

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies
- Ext

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Ext
- CLSID

In HKEY_LOCAL_MACHINE\Software\ZUpdater
- ConvertFilesforFreeUpdt.exe

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- Convert Files for Free

In HKEY_LOCAL_MACHINE\Software\Convert Files for Free
- installed_success

In HKEY_CLASSES_ROOT
- ConvertFilesforFree.1

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ConvertFilesforFree.1
- CLSID

In HKEY_CLASSES_ROOT
- ConvertFilesforFree

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ConvertFilesforFree
- CurVer

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
- ProgID

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
- VersionIndependentProgID

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
- Programmable

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
- InprocServer32

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
- Implemented Categories

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\Implemented Categories
- {59fb2056-d625-48d0-a944-1a85b5ab2640}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
- TypeLib

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
- Version

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
- {22B58425-A384-436C-A334-BB9255664D10}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{22B58425-A384-436C-A334-BB9255664D10}
- 1.0

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{22B58425-A384-436C-A334-BB9255664D10}\1.0
- FLAGS

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{22B58425-A384-436C-A334-BB9255664D10}\1.0
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{22B58425-A384-436C-A334-BB9255664D10}\1.0\0
- win32

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{22B58425-A384-436C-A334-BB9255664D10}\1.0
- HELPDIR

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {951F4658-6461-46AD-AB13-F73E7FCBE6DB}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{951F4658-6461-46AD-AB13-F73E7FCBE6DB}
- ProxyStubClsid

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{951F4658-6461-46AD-AB13-F73E7FCBE6DB}
- ProxyStubClsid32

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{951F4658-6461-46AD-AB13-F73E7FCBE6DB}
- TypeLib

In HKEY_LOCAL_MACHINE\SOFTWARE
- File Type Helper

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg
- command

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths
- FileTypeHelper.exe

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- VOPackage

To delete the registry key this malware/grayware created:

Open Registry Editor.
» For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
» For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software
Still in the left panel, locate and delete the key:
Convert Files for Free
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Convert Files for Free
Still in the left panel, locate and delete the key:
ConvertFilesforFree
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Policies
Still in the left panel, locate and delete the key:
Ext
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Policies>Ext
Still in the left panel, locate and delete the key:
CLSID
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>ZUpdater
Still in the left panel, locate and delete the key:
ConvertFilesforFreeUpdt.exe
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
Still in the left panel, locate and delete the key:
Convert Files for Free
Again Still in the left panel, locate and delete the key:
installed_success
In the left panel, double-click the following:
HKEY_CLASSES_ROOT
Still in the left panel, locate and delete the key:
ConvertFilesforFree.1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ConvertFilesforFree.1
Still in the left panel, locate and delete the key:
CLSID
Again Still in the left panel, locate and delete the key:
ConvertFilesforFree
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ConvertFilesforFree
Still in the left panel, locate and delete the key:
CurVer
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
Still in the left panel, locate and delete the key:
{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
Still in the left panel, locate and delete the key:
ProgID
Again Still in the left panel, locate and delete the key:
VersionIndependentProgID
Again Still in the left panel, locate and delete the key:
Programmable
Again Still in the left panel, locate and delete the key:
InprocServer32
Again Still in the left panel, locate and delete the key:
Implemented Categories
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}>Implemented Categories
Still in the left panel, locate and delete the key:
{59fb2056-d625-48d0-a944-1a85b5ab2640}
Again Still in the left panel, locate and delete the key:
TypeLib
Again Still in the left panel, locate and delete the key:
Version
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
Still in the left panel, locate and delete the key:
{22B58425-A384-436C-A334-BB9255664D10}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{22B58425-A384-436C-A334-BB9255664D10}
Still in the left panel, locate and delete the key:
1.0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{22B58425-A384-436C-A334-BB9255664D10}>1.0
Still in the left panel, locate and delete the key:
FLAGS
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{22B58425-A384-436C-A334-BB9255664D10}>1.0>0
Still in the left panel, locate and delete the key:
win32
Again Still in the left panel, locate and delete the key:
HELPDIR
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
Still in the left panel, locate and delete the key:
{951F4658-6461-46AD-AB13-F73E7FCBE6DB}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{951F4658-6461-46AD-AB13-F73E7FCBE6DB}
Still in the left panel, locate and delete the key:
ProxyStubClsid
Again Still in the left panel, locate and delete the key:
ProxyStubClsid32
Again Still in the left panel, locate and delete the key:
TypeLib
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE
Still in the left panel, locate and delete the key:
File Type Helper
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Unknown>shell>opendlg
Still in the left panel, locate and delete the key:
command
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>App Paths
Still in the left panel, locate and delete the key:
FileTypeHelper.exe
Again Still in the left panel, locate and delete the key:
VOPackage
Close Registry Editor.

Step 4

Delete this registry value

[ Learn More ]

In HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free
- Name = "Convert Files for Free"

In HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free
- Version = "8.25"

In HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\ConvertFilesforFree
- app_id = "5A23FD7D951E47F3BF71EEBFDEA89FDE"

In HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\ConvertFilesforFree
- Channel = "Installmonetize3"

In HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\ConvertFilesforFree
- Root_domen = "www.convertfilesforfree.com/w"

In HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\ConvertFilesforFree
- JS_Domen = "d1798l6lhp8h4d.cloudfront.net/w"

In HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\ConvertFilesforFree
- Name_Main_build = "Convert Files for Free"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext
- ListBox_Support_CLSID = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext\CLSID
- {59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB} = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\ConvertFilesforFreeUpdt.exe
- Version = "8.25"

In HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\ConvertFilesforFreeUpdt.exe
- Folder = "%User Temp%"

In HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\ConvertFilesforFreeUpdt.exe
- Name = "ConvertFilesforFreeUpdt"

In HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\ConvertFilesforFreeUpdt.exe
- Url = "http://www.{BLOCKED}tfilesforfree.com/w/updater/u.php"

In HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\ConvertFilesforFreeUpdt.exe
- app_id = "5A23FD7D951E47F3BF71EEBFDEA89FDE"

In HKEY_LOCAL_MACHINE\SOFTWARE\ZUpdater\ConvertFilesforFreeUpdt.exe
- ext_params = "&channel=Installmonetize3"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Convert Files for Free
- DisplayName = "Convert Files for Free"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Convert Files for Free
- UninstallString = "%Program Files%\Convert Files for Free\uninstall.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Convert Files for Free
- DisplayIcon = "%Program Files%\Convert Files for Free\install.ico"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Convert Files for Free
- DisplayVersion = "8.25"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Convert Files for Free
- URLInfoAbout = "http://www.{BLOCKED}tfilesforfree.com"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Convert Files for Free
- Publisher = "Convert Files for Free"

In HKEY_LOCAL_MACHINE\SOFTWARE\Convert Files for Free\installed_success
- installed_success = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
- NoExplorer = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}\InprocServer32
- ThreadingModel = "Apartment"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{951F4658-6461-46AD-AB13-F73E7FCBE6DB}\TypeLib
- Version = "1.0"

In HKEY_LOCAL_MACHINE\SOFTWARE\File Type Helper
- old_openas = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\File Type Helper
- old_opendlg = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
- DisplayName = "Installer"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
- UninstallString = "%User Profile%\VOPackage\uninstall.exe "

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
- DisplayIcon = "%User Profile%\VOPackage\uninstall.exe "

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
- DisplayVersion = "1.0.0.0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
- Source = "imz"

To delete the registry value this malware/grayware created:

Open Registry Editor.
» For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
» For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Convert Files for Free
In the right panel, locate and delete the entry:
Name = "Convert Files for Free"
Again In the right panel, locate and delete the entry:
Version = "8.25"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Convert Files for Free>ConvertFilesforFree
In the right panel, locate and delete the entry:
app_id = "5A23FD7D951E47F3BF71EEBFDEA89FDE"
Again In the right panel, locate and delete the entry:
Channel = "Installmonetize3"
Again In the right panel, locate and delete the entry:
Root_domen = "www.convertfilesforfree.com/w"
Again In the right panel, locate and delete the entry:
JS_Domen = "d1798l6lhp8h4d.cloudfront.net/w"
Again In the right panel, locate and delete the entry:
Name_Main_build = "Convert Files for Free"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext
In the right panel, locate and delete the entry:
ListBox_Support_CLSID = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext>CLSID
In the right panel, locate and delete the entry:
{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB} = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>ZUpdater>ConvertFilesforFreeUpdt.exe
In the right panel, locate and delete the entry:
Version = "8.25"
Again In the right panel, locate and delete the entry:
Folder = "%User Temp%"
Again In the right panel, locate and delete the entry:
Name = "ConvertFilesforFreeUpdt"
Again In the right panel, locate and delete the entry:
Url = "http://www.{BLOCKED}tfilesforfree.com/w/updater/u.php"
Again In the right panel, locate and delete the entry:
app_id = "5A23FD7D951E47F3BF71EEBFDEA89FDE"
Again In the right panel, locate and delete the entry:
ext_params = "&channel
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>Convert Files for Free
In the right panel, locate and delete the entry:
DisplayName = "Convert Files for Free"
Again In the right panel, locate and delete the entry:
UninstallString = "%Program Files%\Convert Files for Free\uninstall.exe"
Again In the right panel, locate and delete the entry:
DisplayIcon = "%Program Files%\Convert Files for Free\install.ico"
Again In the right panel, locate and delete the entry:
DisplayVersion = "8.25"
Again In the right panel, locate and delete the entry:
URLInfoAbout = "http://www.{BLOCKED}tfilesforfree.com"
Again In the right panel, locate and delete the entry:
Publisher = "Convert Files for Free"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Convert Files for Free>installed_success
In the right panel, locate and delete the entry:
installed_success = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}
In the right panel, locate and delete the entry:
NoExplorer = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{59A062A1-5ECA-4a1a-BC44-B2A9283A8ACB}>InprocServer32
In the right panel, locate and delete the entry:
ThreadingModel = "Apartment"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{951F4658-6461-46AD-AB13-F73E7FCBE6DB}>TypeLib
In the right panel, locate and delete the entry:
Version = "1.0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>File Type Helper
In the right panel, locate and delete the entry:
old_openas = "{random characters}"
Again In the right panel, locate and delete the entry:
old_opendlg = "{random characters}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>VOPackage
In the right panel, locate and delete the entry:
DisplayName = "Installer"
Again In the right panel, locate and delete the entry:
UninstallString = "%User Profile%\VOPackage\uninstall.exe "
Again In the right panel, locate and delete the entry:
DisplayIcon = "%User Profile%\VOPackage\uninstall.exe "
Again In the right panel, locate and delete the entry:
DisplayVersion = "1.0.0.0"
Again In the right panel, locate and delete the entry:
Source = "imz"
Close Registry Editor.

Step 5

Search and delete these components

[ Learn More ]

There may be some components that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%User Temp%\nsu3.tmp\ConvertFilesforFree_8.25_Installmonetize3_release.exe
%User Temp%\nsu3.tmp\VOPackage.exe
%User Temp%\nsu3.tmp\registry.dll
%User Temp%\nsu3.tmp\manlib.dll
%User Temp%\nsu3.tmp\output.txt
%User Temp%\nsy9.tmp\System.dll
%User Temp%\nsy9.tmp\registry.dll
%User Temp%\nsy9.tmp\GetVersion.dll
%User Temp%\nsy9.tmp\inetc.dll
/END
%Program Files%\Convert Files for Free\install.ico
%Program Files%\Convert Files for Free\ConvertFilesforFree.dll
%User Temp%\nsy9.tmp\SimpleSC.dll
%User Temp%\nsy9.tmp\nsExec.dll
%Program Files%\Convert Files for Free\ConvertFilesforFreeUpdt.exe
%User Temp%\helper.exe
%Program Files%\Convert Files for Free\uninstall.exe
0
%Temp%\ConvertFilesforFreeUpdt_update.txt
%User Temp%\nss21.tmp
%Program Files%\File Type Helper\FileTypeHelper_assoc.7z
%User Temp%\nsc25.tmp\nsis7z.dll
%Program Files%\File Type Helper\Magnifier_64.ico
%Program Files%\File Type Helper\FileTypeHelper_assoc.exe
%Program Files%\File Type Helper\FileTypeHelper.exe
isAssoc.txt
%Program Files%\File Type Helper\uninstall.exe
%User Temp%\nsd34.tmp\System.dll
%User Temp%\nsd34.tmp\WmiInspector.dll
%User Temp%\nsd34.tmp\t1.dll
%User Temp%\nsd34.tmp\inetc.dll
%User Temp%\b
%User Temp%\nsd34.tmp\IpConfig.dll
%User Temp%\heu39T.nss
%User Profile%\VOPackage\Uninstall.exe
%Start Menu%\Programs\VOPackage\Configure.lnk

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

Right-click Start then click Search....
In the File name* input box, type the following:
%User Temp%\nsu3.tmp\ConvertFilesforFree_8.25_Installmonetize3_release.exe
%User Temp%\nsu3.tmp\VOPackage.exe
%User Temp%\nsu3.tmp\registry.dll
%User Temp%\nsu3.tmp\manlib.dll
%User Temp%\nsu3.tmp\output.txt
%User Temp%\nsy9.tmp\System.dll
%User Temp%\nsy9.tmp\registry.dll
%User Temp%\nsy9.tmp\GetVersion.dll
%User Temp%\nsy9.tmp\inetc.dll
/END
%Program Files%\Convert Files for Free\install.ico
%Program Files%\Convert Files for Free\ConvertFilesforFree.dll
%User Temp%\nsy9.tmp\SimpleSC.dll
%User Temp%\nsy9.tmp\nsExec.dll
%Program Files%\Convert Files for Free\ConvertFilesforFreeUpdt.exe
%User Temp%\helper.exe
%Program Files%\Convert Files for Free\uninstall.exe
0
%Temp%\ConvertFilesforFreeUpdt_update.txt
%User Temp%\nss21.tmp
%Program Files%\File Type Helper\FileTypeHelper_assoc.7z
%User Temp%\nsc25.tmp\nsis7z.dll
%Program Files%\File Type Helper\Magnifier_64.ico
%Program Files%\File Type Helper\FileTypeHelper_assoc.exe
%Program Files%\File Type Helper\FileTypeHelper.exe
isAssoc.txt
%Program Files%\File Type Helper\uninstall.exe
%User Temp%\nsd34.tmp\System.dll
%User Temp%\nsd34.tmp\WmiInspector.dll
%User Temp%\nsd34.tmp\t1.dll
%User Temp%\nsd34.tmp\inetc.dll
%User Temp%\b
%User Temp%\nsd34.tmp\IpConfig.dll
%User Temp%\heu39T.nss
%User Profile%\VOPackage\Uninstall.exe
%Start Menu%\Programs\VOPackage\Configure.lnk
In the Look In drop-down list, select My Computer then press Enter.
Once located, select the file then press SHIFT+DELETE to delete it.
*Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

Open a Windows Explorer window.
- For Windows Vista, 7, and Server 2008 users, click Start>Computer.
- For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen,then click File Explorer.
In the Search Computer/This PC input box, type:
%User Temp%\nsu3.tmp\ConvertFilesforFree_8.25_Installmonetize3_release.exe
%User Temp%\nsu3.tmp\VOPackage.exe
%User Temp%\nsu3.tmp\registry.dll
%User Temp%\nsu3.tmp\manlib.dll
%User Temp%\nsu3.tmp\output.txt
%User Temp%\nsy9.tmp\System.dll
%User Temp%\nsy9.tmp\registry.dll
%User Temp%\nsy9.tmp\GetVersion.dll
%User Temp%\nsy9.tmp\inetc.dll
/END
%Program Files%\Convert Files for Free\install.ico
%Program Files%\Convert Files for Free\ConvertFilesforFree.dll
%User Temp%\nsy9.tmp\SimpleSC.dll
%User Temp%\nsy9.tmp\nsExec.dll
%Program Files%\Convert Files for Free\ConvertFilesforFreeUpdt.exe
%User Temp%\helper.exe
%Program Files%\Convert Files for Free\uninstall.exe
0
%Temp%\ConvertFilesforFreeUpdt_update.txt
%User Temp%\nss21.tmp
%Program Files%\File Type Helper\FileTypeHelper_assoc.7z
%User Temp%\nsc25.tmp\nsis7z.dll
%Program Files%\File Type Helper\Magnifier_64.ico
%Program Files%\File Type Helper\FileTypeHelper_assoc.exe
%Program Files%\File Type Helper\FileTypeHelper.exe
isAssoc.txt
%Program Files%\File Type Helper\uninstall.exe
%User Temp%\nsd34.tmp\System.dll
%User Temp%\nsd34.tmp\WmiInspector.dll
%User Temp%\nsd34.tmp\t1.dll
%User Temp%\nsd34.tmp\inetc.dll
%User Temp%\b
%User Temp%\nsd34.tmp\IpConfig.dll
%User Temp%\heu39T.nss
%User Profile%\VOPackage\Uninstall.exe
%Start Menu%\Programs\VOPackage\Configure.lnk
Once located, select the file then press SHIFT+DELETE to delete it.
*Note: Read the following Microsoft page if these steps do not work on Windows 7.

Step 6

Search and delete these folders

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.

%System Root%\DOCUME~1
%System Root%\DOCUME~1\Wilbert
%User Profile%\LOCALS~1
%User Temp%\nsu3.tmp
%User Temp%\nsy9.tmp
%Program Files%\Convert Files for Free
%System Root%\Documents and Settings\Wilbert
%Program Files%\File Type Helper
%User Temp%\nsc25.tmp
%User Temp%\nsd34.tmp
%User Profile%\Application Data\VOPackage
%Start Menu%\Programs\VOPackage

To delete malware/grayware/spyware folders:

For Windows 2000, Windows XP, and Windows Server 2003:

Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
In the File name* input box, type:

%System Root%\DOCUME~1
%System Root%\DOCUME~1\Wilbert
%User Profile%\LOCALS~1
%User Temp%\nsu3.tmp
%User Temp%\nsy9.tmp
%Program Files%\Convert Files for Free
%System Root%\Documents and Settings\Wilbert
%Program Files%\File Type Helper
%User Temp%\nsc25.tmp
%User Temp%\nsd34.tmp
%User Profile%\Application Data\VOPackage
%Start Menu%\Programs\VOPackage
In the Look In drop-down list, select My Computer, then press Enter.
Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
Repeat steps 2 to 4 for the remaining folders: %System Root%\DOCUME~1
%System Root%\DOCUME~1\Wilbert
%User Profile%\LOCALS~1
%User Temp%\nsu3.tmp
%User Temp%\nsy9.tmp
%Program Files%\Convert Files for Free
%System Root%\Documents and Settings\Wilbert
%Program Files%\File Type Helper
%User Temp%\nsc25.tmp
%User Temp%\nsd34.tmp
%User Profile%\Application Data\VOPackage
%Start Menu%\Programs\VOPackage

*Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

Open a Windows Explorer window.
- For Windows Vista, 7, and Server 2008 users, click Start>Computer.
- For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
In the Search Computer/This PC input box, type:
%System Root%\DOCUME~1
%System Root%\DOCUME~1\Wilbert
%User Profile%\LOCALS~1
%User Temp%\nsu3.tmp
%User Temp%\nsy9.tmp
%Program Files%\Convert Files for Free
%System Root%\Documents and Settings\Wilbert
%Program Files%\File Type Helper
%User Temp%\nsc25.tmp
%User Temp%\nsd34.tmp
%User Profile%\Application Data\VOPackage
%Start Menu%\Programs\VOPackage
Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
Repeat steps 2-3 for the remaining folders: %System Root%\DOCUME~1
%System Root%\DOCUME~1\Wilbert
%User Profile%\LOCALS~1
%User Temp%\nsu3.tmp
%User Temp%\nsy9.tmp
%Program Files%\Convert Files for Free
%System Root%\Documents and Settings\Wilbert
%Program Files%\File Type Helper
%User Temp%\nsc25.tmp
%User Temp%\nsd34.tmp
%User Profile%\Application Data\VOPackage
%Start Menu%\Programs\VOPackage

*Note: Read the following Microsoft page if these steps do not work on Windows 7.

Step 7

Scan your computer with your Trend Micro product to delete files detected as ADW_VOPACKAGE. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 8

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

%User Temp%\nsf1.tmp
%User Temp%\nsu3.tmp
%User Temp%\nst7.tmp
%User Temp%\nsy9.tmp
%User Temp%\nsc1F.tmp
%User Temp%\nsc25.tmp
%User Temp%\nso32.tmp
%User Temp%\nsd34.tmp

Did this description help? Tell us how we did.

ADW_VOPACKAGE

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

ADW_VOPACKAGE

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific