About PayTime
PayTime is a trojan program that downloads a file called paytime.exe on the infected machine and hijacks the default startpage to point to the file secure32.html. It also brings up periodic popups and attempts to install long distance pornographic diallers.
Removal Instructions
Automatic Removal:
PayTime can be detected and removed
AUTOMATICALLY
by Spyware Doctor, also X-Cleaner.
Manual Removal:
Follow these steps to remove PayTime from your machine. Begin
by backing up your registry and your system, and/or setting a
Restore Point, to prevent trouble if you make a mistake.
- Kill these running processes with Task Manager:
paytime.exe
winstall.exe
- Remove these registry items (if present) with RegEdit:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "PayTime"=C:\WINDOWS\System32\paytime.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "PayTime"=C:\WINDOWS\System32\paytime.exe
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Local Page"=c:\secure32.html
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Start Page"=c:\secure32.html
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Default_Page_URL"=c:\secure32.html
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Local Page"=c:\secure32.html
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Start Page"=c:\secure32.html
- Remove the following files and folders in Explorer if exist:
c:\secure32.html
c:\winstall.exe
WindowsDir+\Desktop.html
SystemDir+\paytime.exe
UserProfile+\Application Data\Install.dat
UserProfile+\Start Menu\Programs\SpySheriff
ProgramFiles+\SpySheriff
ProgramFiles+\Daily Weather Forecast\
Sponsored Links:
Removal Instructions for Other Trojans
| 
